diff --git a/lib/dao.js b/lib/dao.js index 1c9ff392..7ac5ce97 100644 --- a/lib/dao.js +++ b/lib/dao.js @@ -1570,7 +1570,8 @@ DataAccessObject._coerce = function(where) { err.statusCode = 400; throw err; } - return where; + + continue; } var DataType = props[p] && props[p].type; if (!DataType) { diff --git a/test/loopback-dl.test.js b/test/loopback-dl.test.js index 3d5901bb..d770697f 100644 --- a/test/loopback-dl.test.js +++ b/test/loopback-dl.test.js @@ -1445,6 +1445,16 @@ describe('DataAccessObject', function() { assert.deepEqual(where, {or: [{age: 10}, {vip: true}]}); }); + it('continues to coerce properties after a logical operator', function() { + var clause = {and: [{age: '10'}], vip: 'true'}; + + // Key order is predictable but not guaranteed. We prefer false negatives (failure) to false positives. + assert(Object.keys(clause)[0] === 'and', 'Unexpected key order.'); + + where = model._coerce(clause); + assert.deepEqual(where, {and: [{age: 10}], vip: true}); + }); + it('should throw if the where property is not an object', function() { try { // The where clause has to be an object @@ -1497,6 +1507,20 @@ describe('DataAccessObject', function() { assert(error, 'An error should have been thrown'); }); + it('throws an error when malformed logical operators follow valid logical clauses', function() { + var invalid = {and: [{x: 1}], or: 'bogus'}; + + // Key order is predictable but not guaranteed. We prefer false negatives (failure) to false positives. + assert(Object.keys(invalid)[0] !== 'or', 'Unexpected key order.'); + + try { + model._coerce(invalid); + } catch (err) { + error = err; + } + assert(error, 'An error should have been thrown'); + }); + it('should throw if filter property is not an object', function() { var filter = null; try {