From b5261450c3bc4abb2e2fb19b5b1a7aba27982d44 Mon Sep 17 00:00:00 2001 From: Jakob Ackermann Date: Sun, 9 Aug 2020 14:43:11 +0200 Subject: [PATCH] fix(object-id): harden the duck-typing The insufficient validation may otherwise lead to type confusions. REF: NODE-2618 Signed-off-by: Jakob Ackermann --- lib/bson/objectid.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/bson/objectid.js b/lib/bson/objectid.js index 79de40d2..0ebcc034 100644 --- a/lib/bson/objectid.js +++ b/lib/bson/objectid.js @@ -66,7 +66,7 @@ var ObjectID = function ObjectID(id) { } else if (id != null && id.length === 12) { // assume 12 byte string this.id = id; - } else if (id != null && id.toHexString) { + } else if (id != null && typeof id.toHexString === 'function') { // Duck-typing to support ObjectId from different npm packages return id; } else { @@ -357,7 +357,10 @@ ObjectID.isValid = function isValid(id) { } // Duck-Typing detection of ObjectId like objects - if (id.toHexString) { + if ( + typeof id.toHexString === 'function' && + (id.id instanceof _Buffer || typeof id.id === 'string') + ) { return id.id.length === 12 || (id.id.length === 24 && checkForHexRegExp.test(id.id)); }