libmongocrypt-helper 1.20.1.0.1001 → 1.20.3.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f3bd46869436cf55ec31236a73965ec1f198f75809d53e084aebb6c056bead0
-  data.tar.gz: 4868779b572f103a7f7f6ae88ea15032dd829e31c5a85e1f41364bd0d7f17d60
+  metadata.gz: b7037c7cdeb5a2f1fe94446f583e7c953539328df98580028a07f46c296689ec
+  data.tar.gz: 52a6c553f0e7ee8e0c6aca713184fe9c13f7e5babf97c18e4eff17235b8e7109
 SHA512:
-  metadata.gz: 57f84ed485336784bd0dd5008a4d2f893146f3cb4128c121d5e91dc5bb8c80c07f8d7a6e44edd869327876c1b0410b1790b84a0548bb0459b6e7bc53a7151a83
-  data.tar.gz: 27917b4a2c97d98db62661d48f0c3dace264f84f83ba9fd1f9de351dc11a20bb0f29445c51ffa94b82b51716adb1bf925bf18804358d5bac1b701651bc735846
+  metadata.gz: 190dff33114c3f35a8ba07776144bdfde51523e75277176c4c0bf5bdef0be4d500500c3b11eed1520635e43d7b8201faec4faca54da7c99bd119da8d7c3f606e
+  data.tar.gz: 20446b82d1838e42ce90980bea22112b4af933cd66daa0984e15b00f1dde2867f408d87f5ed2f86ec146db64b4f0201c0a9be9cdcc30923e48acff5793ab1aa5

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,5 +1,14 @@
 # ChangeLog
 
+## 1.20.3
+
+### Fixed
+- Validate database and collection name arguments against "." and NUL bytes
+## 1.20.2
+
+### Changed
+- Add checks when creating GCP requests.
+
 ## 1.20.1
 
 ## Changed

data/ext/libmongocrypt/libmongocrypt/Earthfile

@@ -438,12 +438,12 @@ test-deb-packages-from-ppa:
     RUN ./test.out
 
 # `sign` uses Garasign to sign a file with the libmongocrypt key.
-# Requires prior authentication with Artifactory.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 # See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/.
 sign:
     ARG --required file_to_sign
     ARG --required output_file
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg
     WORKDIR /s
     COPY ${file_to_sign} /s/file
     RUN --secret garasign_username --secret garasign_password \
@@ -460,8 +460,9 @@ sign:
 #   An environment with the `silkbomb` command.
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
     # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/CONTRIBUTING.md

@@ -28,6 +28,18 @@ bash scripts/update-version.sh <new-version>
 This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect
 the new vendored version of `libmongocrypt`.
 
+This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR
+registry with the container launcher (`docker` or `podman`) before running the script:
+
+```bash
+aws sso login --profile ECRScopedAccess-901841024863
+
+# Authenticate "podman" or "docker"
+CONTAINER_LAUNCHER="podman"
+
+aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+```
+
 ## Building wheels
 
 To build wheels, run `scripts/release.sh`.  It will build the appropriate wheel for the current system

data/ext/libmongocrypt/libmongocrypt/bindings/python/scripts/update-version.sh

@@ -21,7 +21,7 @@ else
 fi
 
 echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt
-$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
+$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
 rm purls.txt
 
 popd

data/ext/libmongocrypt/libmongocrypt/doc/releasing.md

@@ -93,6 +93,15 @@ Do the following when releasing:
    ```bash
    ./.evergreen/earthly.sh +sbom-generate-new-serial-number
    ```
+   This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR registry with the container launcher (`docker` or `podman`):
+   ```bash
+   aws sso login --profile ECRScopedAccess-901841024863
+
+   # Authenticate "podman" or "docker"
+   CONTAINER_LAUNCHER="podman"
+
+   aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+   ```
    Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`.
 - Remove yourself from the [releases team](https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases) on GitHub via [MANA](https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9).
 - If this is a new non-patch release (e.g. `x.y.0`):
@@ -130,6 +139,7 @@ Do the following when releasing:
      ```bash
      ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
+     Requires AWS SSO access to the `ECRScopedAccess-901841024863` profile (see note above).
      Commit resulting `etc/cyclonedx.sbom.json`.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to leave commentary about the process.

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -57,7 +57,7 @@
     }
   ],
   "metadata": {
-    "timestamp": "2026-07-14T13:56:19.068748+00:00",
+    "timestamp": "2026-08-07T17:48:10.053548+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,7 +100,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:870a42e2-38df-4271-afee-8ffa5c28bcf7",
+  "serialNumber": "urn:uuid:464d2591-6478-4559-a1c4-9a726248fc1e",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/kms-message/src/kms_gcp_request.c

@@ -20,6 +20,8 @@
 #include "kms_message_private.h"
 #include "kms_request_opt_private.h"
 
+#include <ctype.h>
+
 /* Set a default expiration of 5 minutes for JSON Web Tokens (GCP allows up to
  * one hour) */
 #define JWT_EXPIRATION_SECS 5 * 60
@@ -145,6 +147,38 @@ done:
    return req;
 }
 
+/* _check_key_identifier returns true if `value` is safe to use as a URL path segment.
+ *
+ * Key identifiers may originate from key vault documents or caller-supplied options. They are
+ * formatted into the request path, so an unescaped '/', '?', '#', space, or CR/LF would rewrite
+ * the request target or inject header lines into the request.
+ *
+ * Only the RFC 3986 unreserved characters are permitted. This is a superset of what GCP itself
+ * accepts, so it does not reject any identifier that would otherwise work:
+ * - keyRing and keyName must match `[a-zA-Z0-9_-]{1,63}`. See
+ *   https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings/create and
+ *   https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys/create
+ * - projectId is 6-30 characters of lowercase letters, numbers, and hyphens. See
+ *   https://cloud.google.com/resource-manager/docs/creating-managing-projects
+ * - location is a Cloud location name (e.g. "global", "us-east1").
+ * - keyVersion is a positive integer.
+ *
+ * `value` is not included in the error message: it is untrusted, and the error may be logged. */
+static bool
+_check_key_identifier (kms_request_t *req, const char *name, const char *value)
+{
+   const char *c;
+
+   for (c = value; *c != '\0'; c++) {
+      if (!isalnum ((unsigned char) *c) && *c != '-' && *c != '.' && *c != '_' &&
+          *c != '~') {
+         KMS_ERROR (req, "Invalid character in GCP KMS key identifier: %s", name);
+         return false;
+      }
+   }
+   return true;
+}
+
 static kms_request_t *
 _encrypt_decrypt_common (const char *encrypt_decrypt,
                          const char *host,
@@ -192,6 +226,14 @@ _encrypt_decrypt_common (const char *encrypt_decrypt,
       goto done;
    }
 
+   if (!_check_key_identifier (req, "projectId", project_id) ||
+       !_check_key_identifier (req, "location", location) ||
+       !_check_key_identifier (req, "keyRing", key_ring_name) ||
+       !_check_key_identifier (req, "keyName", key_name) ||
+       (key_version && !_check_key_identifier (req, "keyVersion", key_version))) {
+      goto done;
+   }
+
    value_base64 = kms_message_raw_to_b64 (value, value_len);
    if (!value_base64) {
       KMS_ERROR (req, "Could not bases64-encode plaintext");

data/ext/libmongocrypt/libmongocrypt/src/mc-schema-broker.c

@@ -323,7 +323,11 @@ bool mc_schema_broker_satisfy_from_collinfo(mc_schema_broker_t *sb,
             CLIENT_ERR("failed to find 'name' in collinfo in database: %s", sb->db);
             return false;
         }
-        coll = bson_iter_utf8(&name_iter, NULL);
+        uint32_t coll_len;
+        coll = bson_iter_utf8(&name_iter, &coll_len);
+        if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name in collinfo", status)) {
+            return false;
+        }
     }
 
     // Cache the received collinfo.
@@ -508,7 +512,11 @@ bool mc_schema_broker_satisfy_from_create_or_collMod(mc_schema_broker_t *sb,
         CLIENT_ERR("Failed to get collection name from command");
         return false;
     }
-    const char *coll = bson_iter_utf8(&iter, NULL);
+    uint32_t coll_len;
+    const char *coll = bson_iter_utf8(&iter, &coll_len);
+    if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name", status)) {
+        return false;
+    }
 
     // Check if schema was requested.
     mc_schema_entry_t *found = NULL;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-encrypt.c

@@ -2303,7 +2303,11 @@ static bool _check_cmd_for_auto_encrypt_bulkWrite(mongocrypt_binary_t *cmd,
         return false;
     }
 
-    const char *target_ns = bson_iter_utf8(&ns_iter, NULL /* length */);
+    uint32_t target_ns_len;
+    const char *target_ns = bson_iter_utf8(&ns_iter, &target_ns_len);
+    if (!_mongocrypt_check_no_embedded_nul(target_ns, target_ns_len, "namespace in `bulkWrite` command", status)) {
+        return false;
+    }
     // Parse `target_ns` into "<db>.<coll>"
     const char *dot = strstr(target_ns, ".");
     if (!dot) {
@@ -2375,7 +2379,12 @@ _check_cmd_for_auto_encrypt(mongocrypt_binary_t *cmd, bool *bypass, char **targe
     }
 
     if (BSON_ITER_HOLDS_UTF8(&target_coll_iter)) {
-        *target_coll = bson_strdup(bson_iter_utf8(&target_coll_iter, NULL));
+        uint32_t target_coll_len;
+        const char *target_coll_str = bson_iter_utf8(&target_coll_iter, &target_coll_len);
+        if (!_mongocrypt_check_no_embedded_nul(target_coll_str, target_coll_len, "collection name", status)) {
+            return false;
+        }
+        *target_coll = bson_strdup(target_coll_str);
     } else {
         *target_coll = NULL;
     }
@@ -2572,7 +2581,11 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                                    stage_key);
                         return false;
                     }
-                    const char *from = bson_iter_utf8(&lookup_iter, NULL);
+                    uint32_t from_len;
+                    const char *from = bson_iter_utf8(&lookup_iter, &from_len);
+                    if (!_mongocrypt_check_no_embedded_nul(from, from_len, "'from' collection name", status)) {
+                        return false;
+                    }
                     if (!mc_schema_broker_request(sb, db, from, status)) {
                         return false;
                     }
@@ -2631,7 +2644,11 @@ static bool find_collections_in_pipeline(mc_schema_broker_t *sb,
                                    stage_key);
                         return false;
                     }
-                    const char *coll = bson_iter_utf8(&unionWith_iter, NULL);
+                    uint32_t coll_len;
+                    const char *coll = bson_iter_utf8(&unionWith_iter, &coll_len);
+                    if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "'coll' collection name", status)) {
+                        return false;
+                    }
                     if (!mc_schema_broker_request(sb, db, coll, status)) {
                         return false;
                     }
@@ -2722,6 +2739,10 @@ bool mongocrypt_ctx_encrypt_init(mongocrypt_ctx_t *ctx, const char *db, int32_t
         return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db");
     }
 
+    if (strchr(ectx->cmd_db, '.')) {
+        return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db: must not contain a dot");
+    }
+
     if (0 == strcmp(ectx->cmd_name, "bulkWrite")) {
         // Handle `bulkWrite` as a special case.
         // `bulkWrite` includes the target namespaces in an `nsInfo` field.

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-private.h

@@ -161,6 +161,11 @@ typedef enum {
 
 bool _mongocrypt_validate_and_copy_string(const char *in, int32_t in_len, char **out) MONGOCRYPT_WARN_UNUSED_RESULT;
 
+/* _mongocrypt_check_no_embedded_nul returns false and sets @status if @str contains an embedded null byte. See
+ * MONGOCRYPT-977. */
+bool _mongocrypt_check_no_embedded_nul(const char *str, uint32_t len, const char *what, mongocrypt_status_t *status)
+    MONGOCRYPT_WARN_UNUSED_RESULT;
+
 char *_mongocrypt_new_string_from_bytes(const void *in, int len);
 
 /* _mongocrypt_needs_credentials returns true if @crypt was configured to

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt.c

@@ -913,6 +913,17 @@ uint64_t mongocrypt_crypt_shared_lib_version(const mongocrypt_t *crypt) {
     return crypt->csfle.get_version();
 }
 
+bool _mongocrypt_check_no_embedded_nul(const char *str, uint32_t len, const char *what, mongocrypt_status_t *status) {
+    BSON_ASSERT_PARAM(str);
+    BSON_ASSERT_PARAM(what);
+
+    if (strlen(str) != (size_t)len) {
+        CLIENT_ERR("%s must not contain an embedded null byte", what);
+        return false;
+    }
+    return true;
+}
+
 bool _mongocrypt_validate_and_copy_string(const char *in, int32_t in_len, char **out) {
     BSON_ASSERT_PARAM(out);
 

data/ext/libmongocrypt/libmongocrypt/test/test-gcp-auth.c

@@ -242,7 +242,58 @@ static void _test_encrypt_with_accesstoken(_mongocrypt_tester_t *tester) {
     mongocrypt_destroy(crypt);
 }
 
+// Test a CRLF in a key vault document's keyName. Regression test for MONGOCRYPT-960.
+static void _test_crlf_in_gcp_masterkey(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+    mongocrypt_binary_t *uuid;
+    const char *uuid_data = "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61";
+
+    // A key vault document whose masterKey.keyName contains a CRLF.
+    // clang-format off
+    const char *key_doc = BSON_STR({
+        "status" : 1,
+        "_id" : {"$binary" : {"base64" : "YWFhYWFhYWFhYWFhYWFhYQ==", "subType" : "04"}},
+        "masterKey" : {
+            "provider" : "gcp",
+            "projectId" : "test",
+            "location" : "global",
+            "keyRing" : "test",
+            "keyName" : "test\r\nFOOBAR: injected"
+        },
+        "updateDate" : {"$date" : {"$numberLong" : "1557827033449"}},
+        "creationDate" : {"$date" : {"$numberLong" : "1557827033449"}},
+        "keyMaterial" : {
+            "$binary" : {
+                "base64" : "PwwOESbKs57YTJtGSCsuAJbv9VWRHjLdPdziUVxH0K9woZUka4SghSwJlw9n6TU/dYHFODvSa4p7bfKzS6U8kGFvOnd7LcPU63IkTek4qZEbGpTRwI5lMT4FFWdpYpUf",
+                "subType" : "00"
+            }
+        }
+    });
+    // clang-format on
+
+    crypt = mongocrypt_new();
+    ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'gcp': {'accessToken': 'foobar'}}")), crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
+    ctx = mongocrypt_ctx_new(crypt);
+    uuid = mongocrypt_binary_new_from_data((uint8_t *)uuid_data, UUID_LEN);
+    ASSERT_OK(mongocrypt_ctx_setopt_key_id(ctx, uuid), ctx);
+    ASSERT_OK(mongocrypt_ctx_setopt_algorithm(ctx, MONGOCRYPT_ALGORITHM_DETERMINISTIC_STR, -1), ctx);
+    ASSERT_OK(mongocrypt_ctx_explicit_encrypt_init(ctx, TEST_BSON("{'v': 1}")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    /* Constructing the KMS request fails. No request is sent. */
+    ASSERT_FAILS(mongocrypt_ctx_mongo_feed(ctx, TEST_BSON_STR(key_doc)),
+                 ctx,
+                 "Invalid character in GCP KMS key identifier: keyName");
+
+    mongocrypt_binary_destroy(uuid);
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
 void _mongocrypt_tester_install_gcp_auth(_mongocrypt_tester_t *tester) {
+    INSTALL_TEST(_test_crlf_in_gcp_masterkey);
     INSTALL_TEST(_test_createdatakey_with_credentials);
     INSTALL_TEST(_test_encrypt_with_credentials);
     INSTALL_TEST(_test_createdatakey_with_accesstoken);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-encrypt.c

@@ -362,6 +362,119 @@ static void _test_encrypt_init(_mongocrypt_tester_t *tester) {
     mongocrypt_destroy(crypt);
 }
 
+/* Test that a db name containing a dot or an embedded NUL is rejected.
+ * A db name like "a.b" would otherwise produce the namespace "a.b.coll",
+ * retargeting the operation at database "a" and collection "b.coll".
+ * Regression test for MONGOCRYPT-977. */
+static void _test_encrypt_init_invalid_db_collection(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+
+    {
+        /* Dot in db name. */
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "a.b", -1, TEST_FILE("./test/example/cmd.json")),
+                     ctx,
+                     "invalid db");
+        mongocrypt_ctx_destroy(ctx);
+    }
+
+    {
+        /* Embedded NUL in db name. */
+        const char db[] = "a\0b";
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, db, 3, TEST_FILE("./test/example/cmd.json")), ctx, "invalid db");
+        mongocrypt_ctx_destroy(ctx);
+    }
+
+    {
+        /* A dot in a collection name is legal, and must keep working. */
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "test", -1, TEST_BSON("{'find': 'a.b'}")), ctx);
+        mongocrypt_ctx_destroy(ctx);
+    }
+
+    {
+        /* Embedded NUL in the collection name of the command. */
+        bson_t *cmd = bson_new();
+        BSON_ASSERT(bson_append_utf8(cmd, "find", -1, "a\0b", 3));
+        mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin),
+                     ctx,
+                     "collection name must not contain an embedded null byte");
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_binary_destroy(bin);
+        bson_destroy(cmd);
+    }
+
+    {
+        /* Embedded NUL in the `bulkWrite` nsInfo namespace. */
+        bson_t *cmd = bson_new();
+        bson_array_builder_t *nsInfo;
+        bson_t ns0;
+        BSON_ASSERT(BSON_APPEND_INT32(cmd, "bulkWrite", 1));
+        BSON_ASSERT(BSON_APPEND_ARRAY_BUILDER_BEGIN(cmd, "nsInfo", &nsInfo));
+        BSON_ASSERT(bson_array_builder_append_document_begin(nsInfo, &ns0));
+        BSON_ASSERT(bson_append_utf8(&ns0, "ns", -1, "db.coll\0evil", 12));
+        BSON_ASSERT(bson_array_builder_append_document_end(nsInfo, &ns0));
+        BSON_ASSERT(bson_append_array_builder_end(cmd, nsInfo));
+        mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin), ctx, "must not contain an embedded null byte");
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_binary_destroy(bin);
+        bson_destroy(cmd);
+    }
+
+    {
+        /* Embedded NUL in a $lookup 'from' collection name. */
+        bson_t *cmd = bson_new();
+        bson_array_builder_t *pipeline;
+        bson_t stage, lookup;
+        BSON_ASSERT(BSON_APPEND_UTF8(cmd, "aggregate", "coll"));
+        BSON_ASSERT(BSON_APPEND_ARRAY_BUILDER_BEGIN(cmd, "pipeline", &pipeline));
+        BSON_ASSERT(bson_array_builder_append_document_begin(pipeline, &stage));
+        BSON_ASSERT(BSON_APPEND_DOCUMENT_BEGIN(&stage, "$lookup", &lookup));
+        BSON_ASSERT(bson_append_utf8(&lookup, "from", -1, "a\0b", 3));
+        BSON_ASSERT(bson_append_document_end(&stage, &lookup));
+        BSON_ASSERT(bson_array_builder_append_document_end(pipeline, &stage));
+        BSON_ASSERT(bson_append_array_builder_end(cmd, pipeline));
+        mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin),
+                     ctx,
+                     "'from' collection name must not contain an embedded null byte");
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_binary_destroy(bin);
+        bson_destroy(cmd);
+    }
+
+    {
+        /* Embedded NUL in a $unionWith 'coll' collection name. */
+        bson_t *cmd = bson_new();
+        bson_array_builder_t *pipeline;
+        bson_t stage, unionWith;
+        BSON_ASSERT(BSON_APPEND_UTF8(cmd, "aggregate", "coll"));
+        BSON_ASSERT(BSON_APPEND_ARRAY_BUILDER_BEGIN(cmd, "pipeline", &pipeline));
+        BSON_ASSERT(bson_array_builder_append_document_begin(pipeline, &stage));
+        BSON_ASSERT(BSON_APPEND_DOCUMENT_BEGIN(&stage, "$unionWith", &unionWith));
+        BSON_ASSERT(bson_append_utf8(&unionWith, "coll", -1, "a\0b", 3));
+        BSON_ASSERT(bson_append_document_end(&stage, &unionWith));
+        BSON_ASSERT(bson_array_builder_append_document_end(pipeline, &stage));
+        BSON_ASSERT(bson_append_array_builder_end(cmd, pipeline));
+        mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len);
+        mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
+        ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin),
+                     ctx,
+                     "'coll' collection name must not contain an embedded null byte");
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_binary_destroy(bin);
+        bson_destroy(cmd);
+    }
+
+    mongocrypt_destroy(crypt);
+}
+
 static void _test_encrypt_need_collinfo(_mongocrypt_tester_t *tester) {
     mongocrypt_t *crypt;
     mongocrypt_ctx_t *ctx;
@@ -6830,6 +6943,7 @@ static void _test_qe_keyAltName_kms(_mongocrypt_tester_t *tester) {
 void _mongocrypt_tester_install_ctx_encrypt(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_explicit_encrypt_init);
     INSTALL_TEST(_test_encrypt_init);
+    INSTALL_TEST(_test_encrypt_init_invalid_db_collection);
     INSTALL_TEST(_test_encrypt_need_collinfo);
     INSTALL_TEST(_test_encrypt_need_markings);
     INSTALL_TEST(_test_encrypt_csfle_no_needs_markings);

data/lib/libmongocrypt_helper/version.rb

@@ -1,5 +1,5 @@
 module LibmongocryptHelper
-  VERSION = '1.20.1.0.1001'
+  VERSION = '1.20.3.0.1001'
 
-  LIBMONGOCRYPT_VERSION = '1.20.1'
+  LIBMONGOCRYPT_VERSION = '1.20.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: libmongocrypt-helper
 version: !ruby/object:Gem::Version
-  version: 1.20.1.0.1001
+  version: 1.20.3.0.1001
 platform: ruby
 authors:
 - The MongoDB Ruby Team
@@ -1250,7 +1250,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.17
+rubygems_version: 4.0.19
 specification_version: 4
 summary: libmongocrypt convenience package
 test_files: []