[Op.contained]:[1,2]// <@ [1, 2] (PG array contained by operator)
[Op.any]:[2,3]// ANY ARRAY[2, 3]::INTEGER (PG only)
},
status:{
$not:false,// status NOT FALSE
[Op.not]:false,// status NOT FALSE
}
}
})
...
...
@@ -197,15 +197,15 @@ Project.findAll({
### Complex filtering / OR / NOT queries
It's possible to do complex where queries with multiple levels of nested AND, OR and NOT conditions. In order to do that you can use `$or`, `$and` or `$not`:
It's possible to do complex where queries with multiple levels of nested AND, OR and NOT conditions. In order to do that you can use `or`, `and` or `not``Operators`:
Using Sequelize without any aliases improves security.
Some frameworks automatically parse user input into js objects and if you fail to sanitize your input it might be possible to inject an Object with string operators to Sequelize.
Not having any string aliases will make it extremely unlikely that operators could be injected but you should always properly validate and sanitize user input.
For backward compatibility reasons Sequelize sets the following aliases by default -
For better security it is highly advised to use `Sequelize.Op` and not depend on any string alias at all. You can limit alias your application will need by setting `operatorsAliases` option, remember to sanitize user input especially when you are directly passing them to Sequelize methods.
* This is the main class, the entry point to sequelize. To use it, you just need to import sequelize:
...
...
@@ -94,6 +95,8 @@ class Sequelize {
* @param {Array} [options.retry.match] Only retry a query if the error matches one of these strings.
* @param {Integer} [options.retry.max] How many times a failing query is automatically retried. Set to 0 to disable retrying on SQL_BUSY error.
* @param {Boolean} [options.typeValidation=false] Run built in type validators on insert and update, e.g. validate that arguments passed to integer fields are integer-like.
* @param {Object|Boolean} [options.operatorsAliases=true] String based operator alias, default value is true which will enable all operators alias. Pass object to limit set of aliased operators or false to disable completely.
Utils.deprecate('String based operators are now deprecated. Please use Symbol based operators for better security, read more at http://docs.sequelizejs.com/manual/tutorial/querying.html#operators');
this.dialect.QueryGenerator.setOperatorsAliases(Op.LegacyAliases);//Op.LegacyAliases should be removed and replaced by Op.Aliases by v5.0 use
* @param {Object} attr The attribute, which can be either an attribute object from `Model.rawAttributes` or a sequelize object, for example an instance of `sequelize.fn`. For simple string attributes, use the POJO syntax
* @param {string} [comparator='=']
* @param {String|Object} logic The condition. Can be both a simply type, or a further condition (`$or`, `$and`, `.literal` etc.)
* @param {String|Object} logic The condition. Can be both a simply type, or a further condition (`or`, `and`, `.literal` etc.)
* Exposes the validator.js object, so you can extend it with custom validation functions. The validator is exposed both on the instance, and on the constructor.
it('should log deprecated warning if operators aliases were not set',()=>{
sinon.stub(Utils,'deprecate');
Support.createSequelizeInstance();
expect(Utils.deprecate.calledOnce).to.be.true;
expect(Utils.deprecate.args[0][0]).to.be.equal('String based operators are now deprecated. Please use Symbol based operators for better security, read more at http://docs.sequelizejs.com/manual/tutorial/querying.html#operators');
