docs+feat: query schema sanitization contract and skipSanitize option - #3696
Merged
Merged
Conversation
Clarify that validateQuery and the built-in adapter operator allowlist are alternative paths: a validated query schema is the full allowlist and skips sanitizeQuery. Point this out from validators, adapter common API, querying, schema helpers, and the security guide.
Allow opting into defense in depth: with replaceSanitization: false, schema validation still runs but the query is not marked VALIDATED, so adapters continue to enforce their built-in operator and filter allowlist. Default remains true for backward compatibility.
marshallswain
changed the title
Reset shared service options (multi, disableObjectify, paginate) so earlier suite mutations cannot leave create/find in a bad state, and assert create actually returned a document before checking $regex.
Shorter option name that matches the behavior: when true (default), adapter sanitizeQuery is skipped after validateQuery succeeds.
Plain Type.Object without additionalProperties: false omits the keyword, so Ajv accepts unknown query keys. Call that out for validateQuery allowlists, querySyntax guidance, and the security guide.
Soften dual-path wording so skipSanitize: false is not contradictory, clarify validateQuery default options, fix the TypeBox docs link label, and add adapter-level coverage that skipSanitize: false still rejects non-allowlisted operators.
marshallswain
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the intentional dual-mode design for restricting external queries, and adds an opt-in to keep both layers when desired.
Design (unchanged by default)
validateQuery: adapters use the built-in operator/filter allowlist (sanitizeQuery).validateQuery(defaultskipSanitize: true): the query schema is the full allowlist; the adapter skips built-in$operator sanitization for validated queries.New option
skipSanitize: truepreserves current behavior.false, the query is validated by the schema but not stampedVALIDATED, so the adapter allowlist still runs (defense in depth).operators/filterswhen using this option.Docs
validateQueryType.Object({ ... })is permissive under Ajv withoutadditionalProperties: falseTests
VALIDATEDstamping with default andskipSanitize: falseskipSanitize: falsestill rejects$regexTest plan
@feathersjs/schematests including new skipSanitize integration cases