LearnBoost/mongoose — Issue #689: Preventing saves of arbitrary json (stick to schema option?)
Author: jleibund
Created: 2012-01-18 21:18:22+00:00
State: open

This is more of a feature request unless I missed this somewhere:

For some projects it may be perfectly fine, or intended to allow mongoose to save "extra" fields in json data to a model-- as long as it complies with the basic schema. For instance, our frontend posts json objects to be saved like this:

app.post('/protected/job', function(req,res, next){
var body = req.body;
var job = new Job(body);
job.save(function(err){
if (err){
console.log('job save error', err);
return next(err);
}
res.send({status:0,payload:job});
})
});

For security reasons I would like to disallow any fields that are not compliant with the schema - I do not want new arbitrary fields attached to records in mongo that could hide something if someone reverse engineered our interfaces.

Am sure I could write something to prevent this, but it would be nice to have some save options for instance one that enforced that fields stick strictly to the schema defined and no more. It seems as of 2.4.9 of mongoose, if I add additional fields to json and save using the above method, they end up persisting themselves in mongo.