Filter is mutated in place by Query modifiers

[sclamage]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Mongoose version

7.4.0

Node.js version

20.13.1

MongoDB server version

7.0.9

Typescript version (if applicable)

No response

Description

I'm experiencing more or less the same bug reported in #14580 (and also #14567). This was supposedly fixed in the 8.3.5 release, but the below test case fails in every version I tested from 7.3.5 through 8.4.0.

Steps to Reproduce

Here's the test code:

bug().then(() => {});

async function bug() {
    await mongoose.connect('mongodb://127.0.0.1:27017/test');

    const personSchema = new mongoose.Schema({
        name: String,
        age: Number
    });
    const Person = mongoose.model('Person', personSchema);

    const query = [{name: 'Me', age: '20'}, {name: 'You', age: '50'}]
    console.log(query)

    const persons = await Person.find({$or: query})
    console.log(query)

    await mongoose.disconnect()
}

Expected Behavior

I acknowledge that the above code doesn't really look correct - age is a Number, so a query of {age: '50'} doesn't make sense and shouldn't return any results. However, I would definitely not expect find() to modify the query arguments!

When I run this against mongoose 7.3.4 (or earlier) the test code outputs the same query object twice, as expected:

[ { name: 'Me', age: '20' }, { name: 'You', age: '50' } ]
[ { name: 'Me', age: '20' }, { name: 'You', age: '50' } ]

However, if I run this against mongoose 7.4.0 or later, it modifies the query argument in-place, and outputs:

[ { name: 'Me', age: '20' }, { name: 'You', age: '50' } ]
[ { name: 'Me', age: 20 }, { name: 'You', age: 50 } ]

[sclamage]

Thanks for fixing this!

I can see it's fixed in 7.6.13, but it's still broken in 8.4.1 and all 8.x releases that I tested with. Is it possible to include this fix in newer releases too? Thank you!

[vkarpov15]

@sclamage try 8.4.2 or 8.5.5? This fix should be in those releases.

[sclamage]

Thanks! I can confirm my test case succeeds in 8.5.5, but not 8.4.2.

8.5.5 is good enough for me though - thank you!