Merge pull request #15367 from Automattic/vkarpov15/gh-15364

fix: clone POJOs and arrays when casting query filter to avoid mutating objects

Author: vkarpov15

benchmarks/findOneWithCast.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const mongoose = require('../');
+
+run().catch(err => {
+  console.error(err);
+  process.exit(-1);
+});
+
+async function run() {
+  await mongoose.connect('mongodb://127.0.0.1:27017/mongoose_benchmark');
+
+  const SchemaParticipant = new mongoose.Schema(
+    {
+      user: mongoose.Schema.Types.UUID,
+    },
+    {
+      _id: false
+    }
+  );
+
+  const TestSchema = new mongoose.Schema(
+    {
+      participants1: { type: [SchemaParticipant] },
+      participants2: { type: [SchemaParticipant] },
+      participants3: { type: [SchemaParticipant] },
+      participants4: { type: [SchemaParticipant] },
+      participants5: { type: [SchemaParticipant] },
+      date: { type: Number },
+    },
+    {
+      collection: 'test_uuid_mutations',
+    }
+  );
+
+  const TestModel = mongoose.model('Test', TestSchema);
+
+  if (!process.env.MONGOOSE_BENCHMARK_SKIP_SETUP) {
+    await TestModel.deleteMany({});
+  }
+
+  const peer = {
+    user: '1583b99d-8462-4343-8dfd-9105252e5662',
+  };
+
+  const numIterations = 500;
+  const queryStart = Date.now();
+  for (let i = 0; i < numIterations; ++i) {
+    for (let j = 0; j < 10; ++j) {
+      await TestModel.findOne({
+        $or: [
+          { participants1: { $elemMatch: peer } },
+          { participants2: { $elemMatch: peer } },
+          { participants3: { $elemMatch: peer } },
+          { participants4: { $elemMatch: peer } },
+          { participants5: { $elemMatch: peer } }
+        ]
+      });
+    }
+  }
+  const queryEnd = Date.now();
+
+  const results = {
+    'Average findOne time ms': +((queryEnd - queryStart) / numIterations).toFixed(2)
+  };
+
+  console.log(JSON.stringify(results, null, '  '));
+  process.exit(0);
+}

lib/utils.js

@@ -234,6 +234,38 @@ exports.omit = function omit(obj, keys) {
   return ret;
 };
 
+/**
+ * Simplified version of `clone()` that only clones POJOs and arrays. Skips documents, dates, objectids, etc.
+ * @param {*} val
+ * @returns
+*/
+
+exports.clonePOJOsAndArrays = function clonePOJOsAndArrays(val) {
+  if (val == null) {
+    return val;
+  }
+  // Skip documents because we assume they'll be cloned later. See gh-15312 for how documents are handled with `merge()`.
+  if (val.$__ != null) {
+    return val;
+  }
+  if (isPOJO(val)) {
+    val = { ...val };
+    for (const key of Object.keys(val)) {
+      val[key] = exports.clonePOJOsAndArrays(val[key]);
+    }
+    return val;
+  }
+  if (Array.isArray(val)) {
+    val = [...val];
+    for (let i = 0; i < val.length; ++i) {
+      val[i] = exports.clonePOJOsAndArrays(val[i]);
+    }
+    return val;
+  }
+
+  return val;
+};
+
 /**
  * Merges `from` into `to` without overwriting existing properties.
  *
@@ -271,13 +303,7 @@ exports.merge = function merge(to, from, options, path) {
       continue;
     }
     if (to[key] == null) {
-      if (isPOJO(from[key])) {
-        to[key] = { ...from[key] };
-      } else if (Array.isArray(from[key])) {
-        to[key] = [...from[key]];
-      } else {
-        to[key] = from[key];
-      }
+      to[key] = exports.clonePOJOsAndArrays(from[key]);
     } else if (exports.isObject(from[key])) {
       if (!exports.isObject(to[key])) {
         to[key] = {};

test/model.query.casting.test.js

@@ -826,6 +826,34 @@ describe('model query casting', function() {
     assert.equal(res.length, 2);
     assert.deepStrictEqual(res.map(doc => doc.arr[1].id), ['two', 'three']);
   });
+
+  it('should not mutate original object with UUID in query with $elemMatch (gh-15364)', async function() {
+    const schemaParticipant = new Schema(
+      {
+        user: mongoose.Schema.Types.UUID
+      },
+      { _id: false }
+    );
+
+    const TestSchema = new Schema(
+      {
+        participants: { type: [schemaParticipant] },
+        date: { type: Number }
+      }
+    );
+
+    const Test = db.model('Test', TestSchema);
+
+    const peer = {
+      user: new mongoose.mongo.BSON.UUID('1583b99d-8462-4343-8dfd-9105252e5662')
+    };
+
+    const originalUser = peer.user;
+
+    await Test.findOne({ participants: { $elemMatch: peer } });
+
+    assert.strictEqual(peer.user, originalUser);
+  });
 });
 
 function _geojsonPoint(coordinates) {