libmongocrypt-helper 1.19.0.0.1001 → 1.20.3.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b049e3785ef7124bc0172a97aca5a01ac2c883998bf066bd399b23aaa6f7ab29
-  data.tar.gz: b993577d300b0aafe7bd074774829edbe4a54425a1bbe631cdfa6424d73abba7
+  metadata.gz: b7037c7cdeb5a2f1fe94446f583e7c953539328df98580028a07f46c296689ec
+  data.tar.gz: 52a6c553f0e7ee8e0c6aca713184fe9c13f7e5babf97c18e4eff17235b8e7109
 SHA512:
-  metadata.gz: 7effe0b13cb6bdea52e7ae92e8ae7fb3ca8230936d95e128d5e11ee35964ec848e46691fd8342e594918915f268ff3b6fa9a924f65d3015c1c25b17e22fc6e6b
-  data.tar.gz: 4ee52e78b00238026409e733f629ab1067179909d20605c981cd7ce4229ed976ece08fd7f8b4db68645d33cbb571c3a04054e604d9ffbe7e7c5752a8bd98b23b
+  metadata.gz: 190dff33114c3f35a8ba07776144bdfde51523e75277176c4c0bf5bdef0be4d500500c3b11eed1520635e43d7b8201faec4faca54da7c99bd119da8d7c3f606e
+  data.tar.gz: 20446b82d1838e42ce90980bea22112b4af933cd66daa0984e15b00f1dde2867f408d87f5ed2f86ec146db64b4f0201c0a9be9cdcc30923e48acff5793ab1aa5

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,5 +1,35 @@
 # ChangeLog
 
+## 1.20.3
+
+### Fixed
+- Validate database and collection name arguments against "." and NUL bytes
+## 1.20.2
+
+### Changed
+- Add checks when creating GCP requests.
+
+## 1.20.1
+
+## Changed
+- Bump downloaded libbson version from 2.3.0 to 2.3.3 to address configuration error with CMake 4.4.0.
+
+## 1.20.0
+
+### Added
+- Stable support for substring queries.
+
+## 1.19.2
+
+### Added
+- Add static library files to GitHub releases.
+
+## 1.19.1
+
+### Added
+- Restore support for the experimental `prefixPreview` and `suffixPreview` query types.
+
+
 ## 1.19.0
 
 ### Added
@@ -11,6 +41,13 @@
 ### Removed
 - Support for the experimental `prefixPreview` and `suffixPreview` query types.
 
+
+## 1.18.2
+
+### Fixed
+- Add musl arm64 release to GitHub release. This was an omission in 1.18.0.
+- Reject large KMS replies.
+
 ## 1.18.1
 
 ### Fixed

data/ext/libmongocrypt/libmongocrypt/Earthfile

@@ -438,12 +438,12 @@ test-deb-packages-from-ppa:
     RUN ./test.out
 
 # `sign` uses Garasign to sign a file with the libmongocrypt key.
-# Requires prior authentication with Artifactory.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 # See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/.
 sign:
     ARG --required file_to_sign
     ARG --required output_file
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg
     WORKDIR /s
     COPY ${file_to_sign} /s/file
     RUN --secret garasign_username --secret garasign_password \
@@ -460,8 +460,9 @@ sign:
 #   An environment with the `silkbomb` command.
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
     # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 

data/ext/libmongocrypt/libmongocrypt/README.md

@@ -78,6 +78,9 @@ A Windows DLL for x86_64 is available on the Github Releases page. See the [late
 
 Use `gpg` to verify the signature. The public key for `libmongocrypt` is available on https://pgp.mongodb.com/.
 
+## Python Releases ##
+Python releases and tags are signed using the MongoDB Python driver PGP key. Use `gpg` to verify the signature. The public key is available at https://pgp.mongodb.com/python-driver.pub.
+
 
 ### Testing ###
 `test-mongocrypt` mocks all I/O with files stored in the `test/data` and `test/example` directories. Run `test-mongocrypt` from the source directory:

data/ext/libmongocrypt/libmongocrypt/bindings/python/CONTRIBUTING.md

@@ -28,6 +28,18 @@ bash scripts/update-version.sh <new-version>
 This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect
 the new vendored version of `libmongocrypt`.
 
+This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR
+registry with the container launcher (`docker` or `podman`) before running the script:
+
+```bash
+aws sso login --profile ECRScopedAccess-901841024863
+
+# Authenticate "podman" or "docker"
+CONTAINER_LAUNCHER="podman"
+
+aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+```
+
 ## Building wheels
 
 To build wheels, run `scripts/release.sh`.  It will build the appropriate wheel for the current system

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/update-version.sh

@@ -21,7 +21,7 @@ else
 fi
 
 echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt
-$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
+$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
 rm purls.txt
 
 popd

data/ext/libmongocrypt/libmongocrypt/cmake/FetchMongoC.cmake

@@ -2,7 +2,7 @@ include (FetchContent)
 
 # Set the tag that we will fetch.
 # When updating the version of libbson, also update the version in etc/purls.txt and .evergreen/prep_c_driver_source.sh
-set (MONGOC_FETCH_TAG_FOR_LIBBSON "2.3.0" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
+set (MONGOC_FETCH_TAG_FOR_LIBBSON "2.3.3" CACHE STRING "The Git tag of mongo-c-driver that will be fetched to obtain libbson")
 
 # Add an option to disable patching if a patch command is unavailable.
 option (LIBBSON_PATCH_ENABLED "Whether to apply patches to the libbson library" ON)

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -93,6 +93,15 @@ Do the following when releasing:
    ```bash
    ./.evergreen/earthly.sh +sbom-generate-new-serial-number
    ```
+   This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR registry with the container launcher (`docker` or `podman`):
+   ```bash
+   aws sso login --profile ECRScopedAccess-901841024863
+
+   # Authenticate "podman" or "docker"
+   CONTAINER_LAUNCHER="podman"
+
+   aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+   ```
    Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`.
 - Remove yourself from the [releases team](https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases) on GitHub via [MANA](https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9).
 - If this is a new non-patch release (e.g. `x.y.0`):
@@ -130,6 +139,7 @@ Do the following when releasing:
      ```bash
      ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
+     Requires AWS SSO access to the `ECRScopedAccess-901841024863` profile (see note above).
      Commit resulting `etc/cyclonedx.sbom.json`.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to leave commentary about the process.

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -1,16 +1,16 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/mongo-c-driver@v2.3.0#src/libbson",
+      "bom-ref": "pkg:github/mongodb/mongo-c-driver@2.3.3#src/libbson",
       "copyright": "Copyright 2009-present MongoDB, Inc.",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/mongo-c-driver/archive/v2.3.0.tar.gz"
+          "url": "https://github.com/mongodb/mongo-c-driver/archive/2.3.3.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/mongo-c-driver/tree/v2.3.0"
+          "url": "https://github.com/mongodb/mongo-c-driver/tree/2.3.3"
         }
       ],
       "group": "mongodb",
@@ -22,9 +22,9 @@
         }
       ],
       "name": "mongo-c-driver",
-      "purl": "pkg:github/mongodb/mongo-c-driver@v2.3.0#src/libbson",
+      "purl": "pkg:github/mongodb/mongo-c-driver@2.3.3#src/libbson",
       "type": "library",
-      "version": "v2.3.0"
+      "version": "2.3.3"
     },
     {
       "bom-ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz",
@@ -53,11 +53,11 @@
       "ref": "pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz"
     },
     {
-      "ref": "pkg:github/mongodb/mongo-c-driver@v2.3.0#src/libbson"
+      "ref": "pkg:github/mongodb/mongo-c-driver@2.3.3#src/libbson"
     }
   ],
   "metadata": {
-    "timestamp": "2026-05-01T14:49:06.464175+00:00",
+    "timestamp": "2026-08-07T17:48:10.053548+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,7 +100,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:5c89265b-cc3d-4649-878b-17b482325b56",
+  "serialNumber": "urn:uuid:464d2591-6478-4559-a1c4-9a726248fc1e",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/etc/purls.txt

@@ -8,7 +8,7 @@
 # `copyright` property. This information can be manually added.
 
 # libbson is obtained via `cmake/FetchMongoC.cmake`.
-pkg:github/mongodb/mongo-c-driver@v2.3.0?#src/libbson
+pkg:github/mongodb/mongo-c-driver@2.3.3?#src/libbson
 
 # IntelDFP is obtained via `cmake/IntelDFP.cmake`
 pkg:generic/IntelRDFPMathLib@20U2?download_url=https://www.netlib.org/misc/intel/IntelRDFPMathLib20U2.tar.gz

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_gcp_request.c

@@ -20,6 +20,8 @@
 #include "kms_message_private.h"
 #include "kms_request_opt_private.h"
 
+#include <ctype.h>
+
 /* Set a default expiration of 5 minutes for JSON Web Tokens (GCP allows up to
  * one hour) */
 #define JWT_EXPIRATION_SECS 5 * 60
@@ -145,6 +147,38 @@ done:
    return req;
 }
 
+/* _check_key_identifier returns true if `value` is safe to use as a URL path segment.
+ *
+ * Key identifiers may originate from key vault documents or caller-supplied options. They are
+ * formatted into the request path, so an unescaped '/', '?', '#', space, or CR/LF would rewrite
+ * the request target or inject header lines into the request.
+ *
+ * Only the RFC 3986 unreserved characters are permitted. This is a superset of what GCP itself
+ * accepts, so it does not reject any identifier that would otherwise work:
+ * - keyRing and keyName must match `[a-zA-Z0-9_-]{1,63}`. See
+ *   https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings/create and
+ *   https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys/create
+ * - projectId is 6-30 characters of lowercase letters, numbers, and hyphens. See
+ *   https://cloud.google.com/resource-manager/docs/creating-managing-projects
+ * - location is a Cloud location name (e.g. "global", "us-east1").
+ * - keyVersion is a positive integer.
+ *
+ * `value` is not included in the error message: it is untrusted, and the error may be logged. */
+static bool
+_check_key_identifier (kms_request_t *req, const char *name, const char *value)
+{
+   const char *c;
+
+   for (c = value; *c != '\0'; c++) {
+      if (!isalnum ((unsigned char) *c) && *c != '-' && *c != '.' && *c != '_' &&
+          *c != '~') {
+         KMS_ERROR (req, "Invalid character in GCP KMS key identifier: %s", name);
+         return false;
+      }
+   }
+   return true;
+}
+
 static kms_request_t *
 _encrypt_decrypt_common (const char *encrypt_decrypt,
                          const char *host,
@@ -192,6 +226,14 @@ _encrypt_decrypt_common (const char *encrypt_decrypt,
       goto done;
    }
 
+   if (!_check_key_identifier (req, "projectId", project_id) ||
+       !_check_key_identifier (req, "location", location) ||
+       !_check_key_identifier (req, "keyRing", key_ring_name) ||
+       !_check_key_identifier (req, "keyName", key_name) ||
+       (key_version && !_check_key_identifier (req, "keyVersion", key_version))) {
+      goto done;
+   }
+
    value_base64 = kms_message_raw_to_b64 (value, value_len);
    if (!value_base64) {
       KMS_ERROR (req, "Could not bases64-encode plaintext");

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_kmip_response_parser.c

@@ -111,6 +111,10 @@ kms_kmip_response_parser_feed (kms_kmip_response_parser_t *parser,
       uint32_t temp;
       memcpy (&temp, parser->buf->str + FIRST_LENGTH_OFFSET, sizeof (uint32_t));
       parser->first_len = KMS_UINT32_FROM_BE (temp);
+      if (parser->first_len > KMS_PARSER_MAX_RESPONSE_LEN) {
+         KMS_ERROR (parser, "KMS KMIP response too large");
+         return false;
+      }
    }
    return true;
 }

data/ext/libmongocrypt/libmongocrypt/src/mc-efc-private.h

@@ -28,13 +28,15 @@ typedef enum _supported_query_type_flags {
     SUPPORTS_RANGE_QUERIES = 1 << 1,
     // Range preview query supported
     SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES = 1 << 2,
-    // Text search preview query supported
-    SUPPORTS_SUBSTRING_PREVIEW_QUERIES = 1 << 3,
+    // Text search query supported
+    SUPPORTS_SUBSTRING_QUERIES = 1 << 3,
     SUPPORTS_SUFFIX_QUERIES = 1 << 4,
     SUPPORTS_PREFIX_QUERIES = 1 << 5,
-    // prefixPreview and suffixPreview are dropped. Setting this results in an error.
+    // suffixPreview and prefixPreview are deprecated aliases for suffix and prefix, respectively.
     SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES = 1 << 6,
     SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES = 1 << 7,
+    // substring preview query supported
+    SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES = 1 << 8,
 } supported_query_type_flags;
 
 typedef struct _mc_EncryptedField_t {

data/ext/libmongocrypt/libmongocrypt/src/mc-efc.c

@@ -33,8 +33,9 @@ static bool _parse_query_type_string(const char *queryType, supported_query_type
         *out = SUPPORTS_RANGE_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR), qtv)) {
         *out = SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES;
-    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR), qtv)) {
-        *out = SUPPORTS_SUBSTRING_PREVIEW_QUERIES;
+    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR), qtv)
+               || mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR), qtv)) {
+        *out = SUPPORTS_SUBSTRING_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIX_STR), qtv)) {
         *out = SUPPORTS_SUFFIX_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_PREFIX_STR), qtv)) {
@@ -178,20 +179,6 @@ static bool _parse_field(mc_EncryptedFieldConfig_t *efc, bson_t *field, mongocry
         return false;
     }
 
-    if (query_types & SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES) {
-        CLIENT_ERR("Cannot use field '%s' with 'prefixPreview' queries. 'prefixPreview' is unsupported. Use 'prefix' "
-                   "instead.",
-                   field_path);
-        return false;
-    }
-
-    if (query_types & SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES) {
-        CLIENT_ERR("Cannot use field '%s' with 'suffixPreview' queries. 'suffixPreview' is unsupported. Use 'suffix' "
-                   "instead.",
-                   field_path);
-        return false;
-    }
-
     /* Prepend a new mc_EncryptedField_t */
     mc_EncryptedField_t *ef = bson_malloc0(sizeof(mc_EncryptedField_t));
     if (has_keyid) {
@@ -258,7 +245,9 @@ bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc,
 
     if (!bson_iter_init_find(&iter, efc_bson, "strEncodeVersion")) {
         if (all_supported_queries
-            & (SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES)) {
+            & (SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_SUFFIX_QUERIES
+               | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
+               | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
             // Has at least one text search query type, set to latest by default.
             efc->str_encode_version = LATEST_STR_ENCODE_VERSION;
         } else {

data/ext/libmongocrypt/libmongocrypt/src/mc-schema-broker.c

@@ -323,7 +323,11 @@ bool mc_schema_broker_satisfy_from_collinfo(mc_schema_broker_t *sb,
             CLIENT_ERR("failed to find 'name' in collinfo in database: %s", sb->db);
             return false;
         }
-        coll = bson_iter_utf8(&name_iter, NULL);
+        uint32_t coll_len;
+        coll = bson_iter_utf8(&name_iter, &coll_len);
+        if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name in collinfo", status)) {
+            return false;
+        }
     }
 
     // Cache the received collinfo.
@@ -508,7 +512,11 @@ bool mc_schema_broker_satisfy_from_create_or_collMod(mc_schema_broker_t *sb,
         CLIENT_ERR("Failed to get collection name from command");
         return false;
     }
-    const char *coll = bson_iter_utf8(&iter, NULL);
+    uint32_t coll_len;
+    const char *coll = bson_iter_utf8(&iter, &coll_len);
+    if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name", status)) {
+        return false;
+    }
 
     // Check if schema was requested.
     mc_schema_entry_t *found = NULL;

data/ext/libmongocrypt/libmongocrypt/src/mc-textopts.c

@@ -368,15 +368,18 @@ bool mc_TextOpts_to_FLE2TextSearchInsertSpec_for_query(const mc_TextOpts_t *txo,
         CLIENT_ERR("Unexpected query type: %s\n", _mongocrypt_query_type_to_string(query_type));
         return false;
     }
-    case MONGOCRYPT_QUERY_TYPE_PREFIX: {
+    case MONGOCRYPT_QUERY_TYPE_PREFIX:
+    case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED: {
         include_prefix = true;
         break;
     }
-    case MONGOCRYPT_QUERY_TYPE_SUFFIX: {
+    case MONGOCRYPT_QUERY_TYPE_SUFFIX:
+    case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED: {
         include_suffix = true;
         break;
     }
-    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: {
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: {
         include_substring = true;
         break;
     }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-encrypt.c

@@ -890,8 +890,9 @@ static moe_result must_omit_encryptionInformation(const char *command_name,
         bool has_fields_requiring_ei = false;
         for (const mc_EncryptedField_t *ef = efc->fields; ef != NULL; ef = ef->next) {
             if (ef->supported_queries
-                & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES
-                   | SUPPORTS_PREFIX_QUERIES)) {
+                & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUFFIX_QUERIES
+                   | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES
+                   | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
                 has_fields_requiring_ei = true;
                 break;
             }
@@ -1011,8 +1012,9 @@ static bool _fle2_append_compactionTokens(mongocrypt_t *crypt,
         const _mongocrypt_buffer_t *ecoct_buf = mc_ECOCToken_get(ecoct);
 
         if (ptr->supported_queries
-            & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES
-               | SUPPORTS_PREFIX_QUERIES)) {
+            & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES
+               | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
+               | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
             // Append the document {ecoc: <ECOCToken>, anchorPaddingToken: <AnchorPaddingTokenRoot>}
             esct = mc_ESCToken_new(crypto, cl1t, status);
             if (!esct) {
@@ -1522,7 +1524,10 @@ static bool _fle2_finalize_explicit(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_SUFFIX:
         case MONGOCRYPT_QUERY_TYPE_PREFIX:
-        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+        case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED:
         case MONGOCRYPT_QUERY_TYPE_RANGE:
         case MONGOCRYPT_QUERY_TYPE_EQUALITY: marking.u.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_FIND; break;
         default: _mongocrypt_ctx_fail_w_msg(ctx, "Invalid value for EncryptOpts.queryType"); goto fail;
@@ -2087,19 +2092,19 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
 
     if (ctx->opts.query_type.set) {
         const mongocrypt_query_type_t qt = ctx->opts.query_type.value;
-        if (qt == MONGOCRYPT_QUERY_TYPE_PREFIX) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_PREFIX || qt == MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
                 return _mongocrypt_ctx_fail_w_msg(ctx, "prefix query type requires string index type");
             }
         }
-        if (qt == MONGOCRYPT_QUERY_TYPE_SUFFIX) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_SUFFIX || qt == MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
                 return _mongocrypt_ctx_fail_w_msg(ctx, "suffix query type requires string index type");
             }
         }
-        if (qt == MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_SUBSTRING || qt == MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
-                return _mongocrypt_ctx_fail_w_msg(ctx, "substringPreview query type requires string index type");
+                return _mongocrypt_ctx_fail_w_msg(ctx, "substring query type requires string index type");
             }
         }
     }
@@ -2182,7 +2187,10 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_PREFIX:
         case MONGOCRYPT_QUERY_TYPE_SUFFIX:
-        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+        case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED:
             matches = (ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING);
             break;
         default:
@@ -2295,7 +2303,11 @@ static bool _check_cmd_for_auto_encrypt_bulkWrite(mongocrypt_binary_t *cmd,
         return false;
     }
 
-    const char *target_ns = bson_iter_utf8(&ns_iter, NULL /* length */);
+    uint32_t target_ns_len;
+    const char *target_ns = bson_iter_utf8(&ns_iter, &target_ns_len);
+    if (!_mongocrypt_check_no_embedded_nul(target_ns, target_ns_len, "namespace in `bulkWrite` command", status)) {
+        return false;
+    }
     // Parse `target_ns` into "<db>.<coll>"
     const char *dot = strstr(target_ns, ".");
     if (!dot) {
@@ -2367,7 +2379,12 @@ _check_cmd_for_auto_encrypt(mongocrypt_binary_t *cmd, bool *bypass, char **targe
     }
 
     if (BSON_ITER_HOLDS_UTF8(&target_coll_iter)) {
-        *target_coll = bson_strdup(bson_iter_utf8(&target_coll_iter, NULL));
+        uint32_t target_coll_len;
+        const char *target_coll_str = bson_iter_utf8(&target_coll_iter, &target_coll_len);
+        if (!_mongocrypt_check_no_embedded_nul(target_coll_str, target_coll_len, "collection name", status)) {
+            return false;
+        }
+        *target_coll = bson_strdup(target_coll_str);
     } else {
         *target_coll = NULL;
     }
@@ -2564,7 +2581,11 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                                    stage_key);
                         return false;
                     }
-                    const char *from = bson_iter_utf8(&lookup_iter, NULL);
+                    uint32_t from_len;
+                    const char *from = bson_iter_utf8(&lookup_iter, &from_len);
+                    if (!_mongocrypt_check_no_embedded_nul(from, from_len, "'from' collection name", status)) {
+                        return false;
+                    }
                     if (!mc_schema_broker_request(sb, db, from, status)) {
                         return false;
                     }
@@ -2623,7 +2644,11 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                                    stage_key);
                         return false;
                     }
-                    const char *coll = bson_iter_utf8(&unionWith_iter, NULL);
+                    uint32_t coll_len;
+                    const char *coll = bson_iter_utf8(&unionWith_iter, &coll_len);
+                    if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "'coll' collection name", status)) {
+                        return false;
+                    }
                     if (!mc_schema_broker_request(sb, db, coll, status)) {
                         return false;
                     }
@@ -2714,6 +2739,10 @@ bool mongocrypt_ctx_encrypt_init(mongocrypt_ctx_t *ctx, const char *db, int32_t
         return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db");
     }
 
+    if (strchr(ectx->cmd_db, '.')) {
+        return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db: must not contain a dot");
+    }
+
     if (0 == strcmp(ectx->cmd_name, "bulkWrite")) {
         // Handle `bulkWrite` as a special case.
         // `bulkWrite` includes the target namespaces in an `nsInfo` field.

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-private.h

@@ -46,7 +46,12 @@ typedef enum _mongocrypt_query_type_t {
     MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED = 3,
     MONGOCRYPT_QUERY_TYPE_PREFIX = 4,
     MONGOCRYPT_QUERY_TYPE_SUFFIX = 5,
-    MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW = 6,
+    MONGOCRYPT_QUERY_TYPE_SUBSTRING = 6,
+    // prefixPreview and suffixPreview are deprecated aliases for prefix and suffix, respectively. They behave
+    // identically; the distinct values exist for consistency (cf. rangePreview) and to ease eventual removal.
+    MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED = 7,
+    MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED = 8,
+    MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED = 9,
 } mongocrypt_query_type_t;
 
 const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val);

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx.c

@@ -248,6 +248,9 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
     } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_STRING_STR))) {
         ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_STRING;
         ctx->opts.index_type.set = true;
+    } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_TEXTPREVIEW_DEPRECATED_STR))) {
+        _mongocrypt_ctx_fail_w_msg(ctx, "Algorithm 'textPreview' is deprecated, please use 'string'");
+        return false;
     } else {
         char *error = bson_strdup_printf("unsupported algorithm string \"%.*s\"",
                                          algo_str.len <= (size_t)INT_MAX ? (int)algo_str.len : INT_MAX,
@@ -1027,14 +1030,21 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIX_STR))) {
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUFFIX;
         ctx->opts.query_type.set = true;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR))) {
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRING;
+        ctx->opts.query_type.set = true;
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR))) {
-        _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'prefixPreview' is deprecated, please use 'prefix'");
-        return false;
+        // 'prefixPreview' is a deprecated alias for 'prefix'.
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED;
+        ctx->opts.query_type.set = true;
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR))) {
-        _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'suffixPreview' is deprecated, please use 'suffix'");
-        return false;
-    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR))) {
-        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW;
+        // 'suffixPreview' is a deprecated alias for 'suffix'.
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED;
+        ctx->opts.query_type.set = true;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR))) {
+        // TODO: MONGOCRYPT-938 disallow substringPreview
+        // _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'substringPreview' is deprecated, please use 'substring'");
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED;
         ctx->opts.query_type.set = true;
     } else {
         /* don't check if qt_str.len fits in int; we want the diagnostic output */
@@ -1066,7 +1076,10 @@ const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val) {
     case MONGOCRYPT_QUERY_TYPE_RANGE: return "Range";
     case MONGOCRYPT_QUERY_TYPE_PREFIX: return "Prefix";
     case MONGOCRYPT_QUERY_TYPE_SUFFIX: return "Suffix";
-    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: return "SubstringPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRING: return "Substring";
+    case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED: return "PrefixPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED: return "SuffixPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: return "SubstringPreview";
     default: return "Unknown";
     }
 }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-opts.c

@@ -984,6 +984,10 @@ bool _mongocrypt_parse_kms_providers(mongocrypt_binary_t *kms_providers_definiti
         } else if (0 == strcmp(field_name, "kmip") && bson_empty(&field_bson)) {
             kms_providers->need_credentials |= MONGOCRYPT_KMS_PROVIDER_KMIP;
         } else if (0 == strcmp(field_name, "kmip")) {
+            if (0 != (kms_providers->configured_providers & MONGOCRYPT_KMS_PROVIDER_KMIP)) {
+                CLIENT_ERR("kmip KMS provider already set");
+                return false;
+            }
             if (!_mongocrypt_opts_kms_provider_kmip_parse(&kms_providers->kmip_mut, field_name, &field_bson, status)) {
                 return false;
             }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-private.h

@@ -161,6 +161,11 @@ typedef enum {
 
 bool _mongocrypt_validate_and_copy_string(const char *in, int32_t in_len, char **out) MONGOCRYPT_WARN_UNUSED_RESULT;
 
+/* _mongocrypt_check_no_embedded_nul returns false and sets @status if @str contains an embedded null byte. See
+ * MONGOCRYPT-977. */
+bool _mongocrypt_check_no_embedded_nul(const char *str, uint32_t len, const char *what, mongocrypt_status_t *status)
+    MONGOCRYPT_WARN_UNUSED_RESULT;
+
 char *_mongocrypt_new_string_from_bytes(const void *in, int len);
 
 /* _mongocrypt_needs_credentials returns true if @crypt was configured to