Sequelize deprecation warning regarding operator injection attack

You may have seen this deprecation warning printed by Notes:

sequelize deprecated String based operators are now deprecated. Please use Symbol based operators for better security, read more at http://docs.sequelizejs.com/manual/tutorial/querying.html#operators

Nowhere in Notes are we using Sequelize string-based operators, and therefore this would seem to be a spurious error message. In actuality, it is a real issue with potential similar to an SQL injection attack.

This issue queue entry has an in-depth discussion of the security problem:  https://github.com/sequelize/sequelize/issues/8417 with more details in the documentation at http://docs.sequelizejs.com/manual/tutorial/querying.html#operators-security ...

Get Node.js Web Development - Fourth Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.