diff --git a/test/types/sanitizeFilter.test.ts b/test/types/sanitizeFilter.test.ts new file mode 100644 index 00000000000..8028e5850a6 --- /dev/null +++ b/test/types/sanitizeFilter.test.ts @@ -0,0 +1,7 @@ +import { FilterQuery, sanitizeFilter } from 'mongoose'; +import { expectType } from 'tsd'; + +const data = { username: 'val', pwd: { $ne: null } }; +type Data = typeof data; + +expectType>(sanitizeFilter(data)); diff --git a/types/index.d.ts b/types/index.d.ts index 60cac795520..73473b4afe3 100644 --- a/types/index.d.ts +++ b/types/index.d.ts @@ -58,6 +58,12 @@ declare module 'mongoose' { */ export function deleteModel(name: string | RegExp): Mongoose; + /** + * Sanitizes query filters against query selector injection attacks by wrapping + * any nested objects that have a property whose name starts with `$` in a `$eq`. + */ + export function sanitizeFilter(filter: FilterQuery): FilterQuery; + /** Gets mongoose options */ export function get(key: K): MongooseOptions[K];