Fix prevent changes and discard hooks

[SteffenLanger]

Summary

Enable the hooks discard and preventChanges to delete properties containing a dot.

(If you have not already please refer to the contributing guideline as described
here)

• Tell us about the problem your pull request is solving.

Problem
This is about nested objects in PATCH requests. A PATCH request for MongoDB can either replace an entire object through a request like this:
{ "contactPerson": { "lastName": "Doe", "firstName" "John" } }
or it can update an individual property like this:
{ "contactPerson.firstName" "Jane" } }
In the latter case, only the property firstName is will be updated, while lastName will stay intact.

The MongoDB documentation explains this here: https://docs.mongodb.com/manual/reference/operator/update/set/#up._S_set (feathers-mongoose implicitly wraps the object from a PATCH request with a {$set : ...} object).

Currently, however, both discard('contactPerson.firstName') and preventChanges(false, 'contactPerson.firstName') only catch the first PATCH object and ignore the second one.

Expectation
The discard hook would remove both property formats from the PATCH request to prevent updating e. g. passwords, usernames etc.
I would bet that quite a few systems are currently subject to an attack because their owners assume that both discard and preventChanges remove the second PATCH format as well.

Solution
Both hooks check whether there is a property containing the dot on the object itself. If so, delete that property.
The previous behavior remains unchanged: The dot notation will also traverse the object tree. So, both context.data.contactPerson.firstName and context.data['contactPerson.firstName'] will be caught.

• Are there any open issues that are related to this? No.
• Is this PR dependent on PRs in other repos? No.

If so, please mention them to keep the conversations linked together.

Other Information

If there's anything else that's important and relevant to your pull
request, mention that information here. This could include
benchmarks, or other information.

Your PR will be reviewed by a core team member and they will work with you to get your changes merged in a timely manner. If merged your PR will automatically be added to the changelog in the next release.

If your changes involve documentation updates please mention that and link the appropriate PR in feathers-docs.

Thanks for contributing to Feathers! ❤️

[eddyystop]

I'll merge the changes if you fix the tests. Otherwise I'll fix the tests when I next work on the repo.

1. services preventChanges
   checks props
   throw if props found:
   AssertionError: expected [Function] to throw an error
   at Context.it (tests/services/prevent-changes.test.js:49:19)
2. services preventChanges
   throws if first param is "true"
   throw if props found:
   AssertionError: expected [Function] to throw an error

[SteffenLanger]

Thank you for your feedback!

I'll have a look at the tests this week.

[SteffenLanger]

Hey @eddyystop,
I fixed the tests these days. Could you review the pull request again?
Thank you!
Steffen

[eddyystop]

I like these changes. Thanks! Published as 4.14.3 .