feat(query): make sanitizeProjection prevent projecting in paths deselected in the schema

lib/query.js

@@ -4872,7 +4872,17 @@ Query.prototype._applyPaths = function applyPaths() {
     return;
   }
   this._fields = this._fields || {};
-  helpers.applyPaths(this._fields, this.model.schema);
+
+  let sanitizeProjection = undefined;
+  if (this.model != null && utils.hasUserDefinedProperty(this.model.db.options, 'sanitizeProjection')) {
+    sanitizeProjection = this.model.db.options.sanitizeProjection;
+  } else if (this.model != null && utils.hasUserDefinedProperty(this.model.base.options, 'sanitizeProjection')) {
+    sanitizeProjection = this.model.base.options.sanitizeProjection;
+  } else {
+    sanitizeProjection = this._mongooseOptions.sanitizeProjection;
+  }
+
+  helpers.applyPaths(this._fields, this.model.schema, sanitizeProjection);
 
   let _selectPopulatedPaths = true;
 

lib/queryHelpers.js

@@ -145,7 +145,7 @@ exports.createModelAndInit = function createModelAndInit(model, doc, fields, use
  * ignore
  */
 
-exports.applyPaths = function applyPaths(fields, schema) {
+exports.applyPaths = function applyPaths(fields, schema, sanitizeProjection) {
   // determine if query is selecting or excluding fields
   let exclude;
   let keys;
@@ -321,6 +321,10 @@ exports.applyPaths = function applyPaths(fields, schema) {
 
     // User overwriting default exclusion
     if (type.selected === false && fields[path]) {
+      if (sanitizeProjection) {
+        fields[path] = 0;
+      }
+
       return;
     }
 
@@ -345,8 +349,10 @@ exports.applyPaths = function applyPaths(fields, schema) {
 
       // if there are other fields being included, add this one
       // if no other included fields, leave this out (implied inclusion)
-      if (exclude === false && keys.length > 1 && !~keys.indexOf(path)) {
+      if (exclude === false && keys.length > 1 && !~keys.indexOf(path) && !sanitizeProjection) {
         fields[path] = 1;
+      } else if (exclude == null && sanitizeProjection && type.selected === false) {
+        fields[path] = 0;
       }
 
       return;

test/query.test.js

@@ -3449,6 +3449,47 @@ describe('Query', function() {
     assert.deepEqual(q._fields, { email: 1 });
   });
 
+  it('sanitizeProjection option with plus paths (gh-14333) (gh-10243)', async function() {
+    const MySchema = Schema({
+      name: String,
+      email: String,
+      password: { type: String, select: false }
+    });
+    const Test = db.model('Test', MySchema);
+
+    await Test.create({ name: 'test', password: 'secret' });
+
+    let q = Test.findOne().select('+password');
+    let doc = await q;
+    assert.deepEqual(q._fields, {});
+    assert.strictEqual(doc.password, 'secret');
+
+    q = Test.findOne().setOptions({ sanitizeProjection: true }).select('+password');
+    doc = await q;
+    assert.deepEqual(q._fields, { password: 0 });
+    assert.strictEqual(doc.password, undefined);
+
+    q = Test.find().select('+password').setOptions({ sanitizeProjection: true });
+    doc = await q;
+    assert.deepEqual(q._fields, { password: 0 });
+    assert.strictEqual(doc.password, undefined);
+
+    q = Test.find().select('name +password').setOptions({ sanitizeProjection: true });
+    doc = await q;
+    assert.deepEqual(q._fields, { name: 1 });
+    assert.strictEqual(doc.password, undefined);
+
+    q = Test.find().select('+name').setOptions({ sanitizeProjection: true });
+    doc = await q;
+    assert.deepEqual(q._fields, { password: 0 });
+    assert.strictEqual(doc.password, undefined);
+
+    q = Test.find().select('password').setOptions({ sanitizeProjection: true });
+    doc = await q;
+    assert.deepEqual(q._fields, { password: 0 });
+    assert.strictEqual(doc.password, undefined);
+  });
+
   it('sanitizeFilter option (gh-3944)', function() {
     const MySchema = Schema({ username: String, pwd: String });
     const Test = db.model('Test', MySchema);

test/schema.select.test.js

@@ -346,6 +346,19 @@ describe('schema select option', function() {
       assert.equal(d.id, doc.id);
     });
 
+    it('works if only one plus path and only one deselected field', async function() {
+      const MySchema = Schema({
+        name: String,
+        email: String,
+        password: { type: String, select: false }
+      });
+      const Test = db.model('Test', MySchema);
+      const { _id } = await Test.create({ name: 'test', password: 'secret' });
+
+      const doc = await Test.findById(_id).select('+password');
+      assert.strictEqual(doc.password, 'secret');
+    });
+
     it('works with query.slice (gh-1370)', async function() {
       const M = db.model('Test', new Schema({ many: { type: [String], select: false } }));