Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection

@@ -133,7 +133,7 @@ class Service extends AdapterService {
     }, params.sequelize);
 
     if (filters.$select) {
-      q.attributes = filters.$select;
+      q.attributes = filters.$select.map(select => `${select}`);
     }
 
     const Model = this.applyScope(params);

@@ -293,6 +293,12 @@ describe('Feathers Sequelize Service', () => {
         await people.remove(person.id);
       });
 
+      it('does not allow raw attribute $select ', async () => {
+        await assert.rejects(() => people.find({
+          query: { $select: [['(sqlite_version())', 'x']] }
+        }));
+      });
+
       it('hides the Sequelize error in ERROR symbol', async () => {
         try {
           await people.create({