find() query on a model by non existing property returns whole collection

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

find() query on a model by non existing property returns whole collection.

If the current behavior is a bug, please provide the steps to reproduce.

const templateSchema = mongoose.Schema({
  title: { type: String, required: true },
}, {
  timestamps: true,
  versionKey: false,
})

const Template = mongoose.model('Template', templateSchema)

await Template.create({ title: 'some title' })
const queryResult = await Template.find({ test: 'test' })
console.log(queryResult)
// [{ 
// _id: new ObjectId("5adf374309ee5958d92c4133"),
//  updatedAt: 2020-03-19T12:50:33.280Z,
//  createdAt: 2020-04-24T13:55:15.779Z,
//  title: 'some title',
// }]

If enable mongoose debug, next query to DB will be logged:

Mongoose: templates.find({}, { projection: {} })

What is the expected behavior?

1. find() query on a model by non existing property returns empty array.
2. Not sure here, query to DB should be templates.find({ test: ‘test’ }, { projection: {} }) or DB should not be queried at all?

What are the versions of Node.js, Mongoose and MongoDB you are using? Note that “latest” is not a version. Node.js: v14.17.4 Mongo: v4.0.18 Mongoose: 6.0.6

[vkarpov15]

We added back the strictQuery option for 6.0.10. If this behavior is causing issues for you, you can add the below code before defining any models or schemas to opt out:

mongoose.set('strictQuery', false);

I’m sorry for the inconvenience and confusion this issue caused.

[xoxoxo]

I was pointed here and I agree this should not behave like it is now. It should reflect mongodb. It could easily lead to some security issues or just dumb errors. I want my schema to be validated on update/save only. Here is example that could lead to sec issues.

const userSchema = mongoose.Schema({
  userName: { type: String, required: true },
})

userSchema.findOne({
  usersName:  'someuser'
});

It will return random user from db as we made a mistake and added extra S in ‘users’;