V6: Removing operator aliases

With the v6 release we are looking to entirely remove operator aliasing support eg. $eq $gt $and etc. in favor of the symbol based operators introduced in v4 and enabled by default in v5.

Aliased operators are potentially vulnerable to user input injection when passing certain user generated input into sequelize calls. This is especially problematic for query string parsers that support complex data structures. For more details please see previous migration guides and documentation.

[stalniy]

I don’t think using symbols instead of string keys somehow improves security.

the issue is not in strings or symbols but in how apps process user input. Even documentation says something like: it will help but don’t forget to sanitize input. With symbols, a dev can make his code vulnerable to injection as well, the only thing which needs to be done is to map string keys to symbol keys.

Frankly speaking, not a big deal 😃 I don’t think symbols operators somehow help but add a bit of complexity.

[stalniy]

@kevinlammers it always was the problem of the developer not sequelize (I argued about the purpose of removing operators in previous comments https://github.com/sequelize/sequelize/issues/10820#issuecomment-501959070).

Now the “life” is a bit more complicated, it’s more complicated to send a silly/hard coded sequelize query from client to server. But it was always a wrong approach!

If you want to do rich filtering or sorting from the client, you need to

1. create your own client to server language,
2. create language translator which converts your language into sequelize query.
3. During translation process don’t forget to prevent different injection attacks.