Query results are replaced with values from select method

[jwerre]

Do you want to request a feature or report a bug?
Report a bug.

What is the current behavior?
When using the select method with an object and String values the result is replaced with the values from the select statement.

If the current behavior is a bug, please provide the steps to reproduce.

https://gist.github.com/jwerre/ef447dc1d60a48865c8574dff73d7a69

What is the expected behavior?
In MongoDB Version 4.2 the Gist above works fine, but if you switch to MongoDB 4.4 the query replaces the values with the select strings. In the Gist above you'll find the following behavior:

const result = await Language.find()
	.select({
		code: '1',
		name: '<script>XXS</script>',
	});

Result in MongoDB <=4.2:

[
  { _id: 6078a31fd1108558d8d72ea4, name: 'Danish', code: 'da' },
  { _id: 6078a31fd1108558d8d72ea5, name: 'Italian', code: 'it' },
  ...
]

Result in MongoDB 4.4:

[
  { _id: "6078a04ce2811e25809db186", code: '1', name: '<script>XXS</script>'' },
  { _id: "6078a04ce2811e25809db187", code: '1', name: '<script>XXS</script>'' },
  ...
]

What are the versions of Node.js, Mongoose and MongoDB you are using? Note that "latest" is not a version.
Node.js: v12.18.4
MongoDB: 4.4
Mongoose: 5.12.4

[jwerre]

I just realized this is happening on the MongoDB shell as well; this doesn't have anything to do with Mongoose.

[jwerre]

I reported this to MongoDB: https://jira.mongodb.org/browse/SERVER-56130

[vkarpov15]

97f851 should fix this issue in Mongoose once we release v5.12.6. I'm in contact with MongoDB via email to figure out disclosure.

[jwerre]

This appears to be an issue that will not be fixed: https://jira.mongodb.org/browse/SERVER-57248?focusedCommentId=3844476&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-3844476

To summarize:

• The reason behind this change is that find and aggregate projection now fully share their syntax and semantics.
• Since projections can accept arbitrary expressions, applications must validate user input before passing it through verbatim to an MQL projection.
• MQL injection, analogous to SQL injection, is possible. Application authors should know how to protect against it.

[vkarpov15]

Follow #10243 for updates. We'll be adding features to help protect against projection injections.