Add $field operator to compare fields #23
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently you can only compare fields to constants. This new operator allows you to compare fields with fields. For example playerCount < maxPlayers This is an exception to the mongodb syntax as mongodb doesn't support this.
ErikSom
approved these changes
Aug 9, 2024
koenbollen
reviewed
Aug 9, 2024
There was a problem hiding this comment.
Nice! Some comments tho.
Security concern: Does this allow a client to probe a field you don't what them to? (e.g. creating a lobby with name "A" and comparing lobby name to password or something)
We haven't thought at all about access management in this library, maybe we could introduce an option to specify fields allowed. Or fields disallowed. (this would be for a different PR ofc).
|
These changes don't add any new security issues. The main security issue is tracked here: #24 |
koenbollen
previously approved these changes
Aug 25, 2024
Co-authored-by: Koen Bollen <[email protected]>
Co-authored-by: Koen Bollen <[email protected]>
koenbollen
approved these changes
Aug 25, 2024
erikdubbelboer
added a commit
to poki/netlib
that referenced
this pull request
Aug 30, 2024
This will enable the new `$field` operator, which will allow you to
filter lobbies like:
```json
{
"playerCount": { "$lt": { "$field": "maxPlayers" } }
}
```
See: poki/mongodb-filter-to-postgres#23
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently you can only compare fields to constants. This new operator allows you to compare fields with fields.
For example
playerCount < maxPlayersThis is an exception to the mongodb syntax as mongodb doesn't support this without
$exprwhich we don't support because it's not JSON compatible.