fix(query): shallow clone $or and $and array elements to avoid mutati…

…ng query filter arguments

Fix #14610

lib/query.js

@@ -2416,13 +2416,17 @@ Query.prototype.merge = function(source) {
   }
 
   opts.omit = {};
-  if (this._conditions && this._conditions.$and && source.$and) {
+  if (this._conditions && Array.isArray(source.$and)) {
     opts.omit['$and'] = true;
-    this._conditions.$and = this._conditions.$and.concat(source.$and);
+    this._conditions.$and = (this._conditions.$and || []).concat(
+      source.$and.map(el => utils.isPOJO(el) ? utils.merge({}, el) : el)
+    );
   }
-  if (this._conditions && this._conditions.$or && source.$or) {
+  if (this._conditions && Array.isArray(source.$or)) {
     opts.omit['$or'] = true;
-    this._conditions.$or = this._conditions.$or.concat(source.$or);
+    this._conditions.$or = (this._conditions.$or || []).concat(
+      source.$or.map(el => utils.isPOJO(el) ? utils.merge({}, el) : el)
+    );
   }
 
   // plain object

lib/utils.js

@@ -294,6 +294,8 @@ exports.merge = function merge(to, from, options, path) {
       to[key] = from[key];
     }
   }
+
+  return to;
 };
 
 /**

test/query.test.js

@@ -4214,4 +4214,19 @@ describe('Query', function() {
     assert.strictEqual(doc.account.owner, undefined);
     assert.strictEqual(doc.account.taxIds, undefined);
   });
+
+  it('avoids mutating $or, $and elements when casting (gh-14610)', async function() {
+    const personSchema = new mongoose.Schema({
+      name: String,
+      age: Number
+    });
+    const Person = db.model('Person', personSchema);
+
+    const filter = [{ name: 'Me', age: '20' }, { name: 'You', age: '50' }];
+    await Person.find({ $or: filter });
+    assert.deepStrictEqual(filter, [{ name: 'Me', age: '20' }, { name: 'You', age: '50' }]);
+
+    await Person.find({ $and: filter });
+    assert.deepStrictEqual(filter, [{ name: 'Me', age: '20' }, { name: 'You', age: '50' }]);
+  });
 });