fix: avoid copying Object.prototype properties when cloning

Fix #9876

lib/helpers/clone.js

@@ -111,7 +111,7 @@ function cloneObject(obj, options, isArrayChild) {
   const ret = {};
   let hasKeys;
 
-  for (const k in obj) {
+  for (const k of Object.keys(obj)) {
     if (specialProperties.has(k)) {
       continue;
     }

lib/helpers/query/castFilterPath.js

@@ -25,7 +25,7 @@ module.exports = function castFilterPath(query, schematype, val) {
       if (nested && schematype && !schematype.caster) {
         const _keys = Object.keys(nested);
         if (_keys.length && isOperator(_keys[0])) {
-          for (const key in nested) {
+          for (const key of Object.keys(nested)) {
             nested[key] = schematype.castForQueryWrapper({
               $conditional: key,
               val: nested[key],

lib/helpers/update/castArrayFilters.js

@@ -38,8 +38,7 @@ module.exports = function castArrayFilters(query) {
     if (filter == null) {
       throw new Error(`Got null array filter in ${arrayFilters}`);
     }
-    for (const key in filter) {
-
+    for (const key of Object.keys(filter)) {
       if (filter[key] == null) {
         continue;
       }

lib/query.js

@@ -4966,7 +4966,7 @@ Query.prototype.tailable = function(val, opts) {
   }
 
   if (opts && typeof opts === 'object') {
-    for (const key in opts) {
+    for (const key of Object.keys(opts)) {
       if (key === 'awaitdata') {
         // For backwards compatibility
         this.options[key] = !!opts[key];

lib/schema.js

@@ -694,18 +694,18 @@ Schema.prototype.path = function(path, obj) {
   }
 
   if (schemaType.$isSingleNested) {
-    for (const key in schemaType.schema.paths) {
+    for (const key of Object.keys(schemaType.schema.paths)) {
       this.singleNestedPaths[path + '.' + key] = schemaType.schema.paths[key];
     }
-    for (const key in schemaType.schema.singleNestedPaths) {
+    for (const key of Object.keys(schemaType.schema.singleNestedPaths)) {
       this.singleNestedPaths[path + '.' + key] =
         schemaType.schema.singleNestedPaths[key];
     }
-    for (const key in schemaType.schema.subpaths) {
+    for (const key of Object.keys(schemaType.schema.subpaths)) {
       this.singleNestedPaths[path + '.' + key] =
         schemaType.schema.subpaths[key];
     }
-    for (const key in schemaType.schema.nested) {
+    for (const key of Object.keys(schemaType.schema.nested)) {
       this.singleNestedPaths[path + '.' + key] = 'nested';
     }
 
@@ -1156,7 +1156,7 @@ Schema.prototype.hasMixedParent = function(path) {
   path = '';
   for (let i = 0; i < subpaths.length; ++i) {
     path = i > 0 ? path + '.' + subpaths[i] : subpaths[i];
-    if (path in this.paths &&
+    if (this.paths.hasOwnProperty(path) &&
         this.paths[path] instanceof MongooseTypes.Mixed) {
       return this.paths[path];
     }

lib/utils.js

@@ -332,7 +332,7 @@ exports.toObject = function toObject(obj) {
   if (exports.isPOJO(obj)) {
     ret = {};
 
-    for (const k in obj) {
+    for (const k of Object.keys(obj)) {
       if (specialProperties.has(k)) {
         continue;
       }

package.json

@@ -25,7 +25,7 @@
     "mongodb": "3.6.4",
     "mongoose-legacy-pluralize": "1.0.2",
     "mpath": "0.8.3",
-    "mquery": "3.2.3",
+    "mquery": "3.2.4",
     "ms": "2.1.2",
     "regexp-clone": "1.0.0",
     "safe-buffer": "5.2.1",