Merge pull request #1717 from strongloop/fix/include-crash-3x

fix: normalize include with boolean or number
loopbackio · Apr 12, 2019 · 22f8bab · 22f8bab
2 parents 127b45b + d67aeb1
commit 22f8bab
Show file tree

Hide file tree

Showing 2 changed files with 42 additions and 0 deletions.
diff --git a/lib/include.js b/lib/include.js
@@ -16,6 +16,8 @@ const uniq = utils.uniq;
 const idName = utils.idName;
 const debug = require('debug')('loopback:include');
 
+const DISALLOWED_TYPES = ['boolean', 'number', 'symbol', 'function'];
+
 /*!
  * Normalize the include to be an array
  * @param include
@@ -47,6 +49,9 @@ function normalizeInclude(include) {
       newInclude = newInclude.concat(subIncludes);
     }
     return newInclude;
+  } else if (DISALLOWED_TYPES.includes(typeof include)) {
+    debug('Ignoring invalid "include" value of type %s:', typeof include, include);
+    return [];
   } else {
     return include;
   }

diff --git a/test/include.test.js b/test/include.test.js
@@ -1254,6 +1254,43 @@ describe('include', function() {
     });
   });
 
+  it('should not throw on fetch User if include is boolean equals true', function(done) {
+    User.find({include: true}, function(err, users) {
+      if (err) return done(err);
+      should.exist(users);
+      users.should.not.be.empty();
+      done();
+    });
+  });
+
+  it('should not throw on fetch User if include is number', function(done) {
+    User.find({include: 1}, function(err, users) {
+      if (err) return done(err);
+      should.exist(users);
+      users.should.not.be.empty();
+      done();
+    });
+  });
+
+  it('should not throw on fetch User if include is symbol', function(done) {
+    User.find({include: Symbol('include')}, function(err, users) {
+      if (err) return done(err);
+      should.exist(users);
+      users.should.not.be.empty();
+      done();
+    });
+  });
+
+  it('should not throw on fetch User if include is function', function(done) {
+    const include = () => {};
+    User.find({include}, function(err, users) {
+      if (err) return done(err);
+      should.exist(users);
+      users.should.not.be.empty();
+      done();
+    });
+  });
+
   // Not implemented correctly, see: loopback-datasource-juggler/issues/166
   // fixed by DB optimization
   it('should support include scope on hasAndBelongsToMany', function(done) {