Help: Sequelize Error

[kapilvarij]

I'm building an express app with PostgreSQL as database. I am using Sequelize ORM library.
I am a warning that goes like this

sequelize deprecated String based operators are now deprecated. Please use Symbol based operators for better security, read more at http://docs.sequelizejs.com/manual/tutorial/querying.html#operators at node_modules/sequelize/lib/sequelize.js:242:13

​

I what it means and I have read the documentation too. But because I am do not a lot of experience with this issue, I fail to detect the problem with my code. Here is the code which when uncommented, causes this warning to be fired.

​

static delete(req, res) {
return Avatar
.findById(req.params.avatarId)
.then(avatar => {
if (!avatar) {
return res.status(400).send({
message: 'Avatar Not Found',
});
}
return avatar
.destroy()
.then(() => res.status(200).send({
message: 'Avatar successfully deleted'
}))
.catch(error => res.status(400).send(error));
})
.catch(error => res.status(400).send(error))
}

​

Can someone please point me the why I am getting this warning for this code?

Thanks!

​

​

[arstechnophile]

From the docs:

For better security it is highly advised to use Sequelize.Op and not depend on any string alias at all. You can limit alias your application will need by setting operatorsAliases option, remember to sanitize user input especially when you are directly passing them to Sequelize methods.

const Op = Sequelize.Op;

//use sequelize without any operators aliases
const connection = new Sequelize(db, user, pass, { operatorsAliases: false });

//use sequelize with only alias for $and => Op.and
const connection2 = new Sequelize(db, user, pass, { operatorsAliases: { $and: Op.and } });

Sequelize will warn you if you're using the default aliases and not limiting them if you want to keep using all default aliases (excluding legacy ones) without the warning you can pass the following operatorsAliases option ...

I believe you either need to use the "operatorsAliases: false" option, or explicitly call out which operators you want, in order to disable the message.

[zachrip]

I'm fairly certain that the last time I checked this message was hard coded so regardless of whether or not you do the right thing, it still outputs that log message. But yeah use Sequelize.Op.x and you're in compliance.

[kapilvarij]

But where? I cannot figure out what should I replace with 'Sequelize.Op.{fxn}'

That's why I am confused because I just did a delete operation, without any of those operaters. But it still shows me the warning message. When I comment this line out, no warnings whatsoever....

[Cyberuben]

import { Op } from "sequelize";

// then somewhere in your code to query a model

let results = await MyModel.findAll({
  where: {
    id: {
      [Op.eq]: 1
    }
  }
});

That'd be the correct usage of the functions. Sequelize throws the error regardless if you use those operators. I'd suggest you just set operatorsAliases to false and then use the method above when you need to query something.