gh-2406 make copy of update parameters

Author: alabid

lib/model.js

@@ -1629,6 +1629,12 @@ Model.create = function create (doc, fn) {
 
 Model.update = function update (conditions, doc, options, callback) {
   var mq = new Query({}, {}, this, this.collection);
+  // gh-2406
+  // make local deep copy of non-function parameters
+  conditions = utils.clone(conditions);
+  doc = utils.clone(doc);
+  options = typeof options === 'function' ? options : utils.clone(options);
+
   return mq.update(conditions, doc, options, callback);
 };
 

test/model.update.test.js

@@ -305,6 +305,19 @@ describe('model: update:', function(){
     });
   });
 
+  it('makes copy of conditions and update options', function(done) {
+    var db = start()
+      , BlogPost = db.model('BlogPostForUpdates', collection);
+
+    var conditions = { '_id': post._id.toString() };
+    var update = {'$set':{'some_attrib':post._id.toString()}};
+    BlogPost.update(conditions, update, function(err) {
+      assert.ifError(err);
+      assert.equal('string', typeof conditions._id);
+      done();
+    });
+  });
+
   it('handles weird casting (gh-479)', function(done){
     var db = start()
       , BlogPost = db.model('BlogPostForUpdates', collection)
@@ -357,7 +370,7 @@ describe('model: update:', function(){
         assert.equal(1, ret._doc.comments[0]._doc.newprop);
         assert.strictEqual(undefined, ret._doc.comments[1]._doc.newprop);
         assert.ok(ret.date instanceof Date);
-        assert.equal(ret.date.toString(), update.$set.date.toString());
+        assert.equal(ret.date.toString(), new Date(update.$set.date).toString());
 
         last = ret;
         done();