mongoid 7.6.1 → 8.0.1

data/spec/mongoid/extensions/hash_spec.rb

@@ -290,6 +290,26 @@ describe Mongoid::Extensions::Hash do
     it "returns the hash" do
       expect(Hash.demongoize(hash)).to eq(hash)
     end
+
+    context "when object is nil" do
+      let(:demongoized) do
+        Hash.demongoize(nil)
+      end
+
+      it "returns nil" do
+        expect(demongoized).to be_nil
+      end
+    end
+
+    context "when the object is uncastable" do
+      let(:demongoized) do
+        Hash.demongoize(1)
+      end
+
+      it "returns the object" do
+        expect(demongoized).to eq(1)
+      end
+    end
   end
 
   describe ".mongoize" do
@@ -326,6 +346,16 @@ describe Mongoid::Extensions::Hash do
         expect(mongoized).to be_nil
       end
     end
+
+    context "when the object is uncastable" do
+      let(:mongoized) do
+        Hash.mongoize(1)
+      end
+
+      it "returns nil" do
+        expect(mongoized).to be_nil
+      end
+    end
   end
 
   describe "#mongoize" do
@@ -467,240 +497,4 @@ describe Mongoid::Extensions::Hash do
 
     it_behaves_like 'unsatisfiable criteria method'
   end
-
-  describe '#to_criteria' do
-    subject(:criteria) { hash.to_criteria }
-
-    context 'when klass is specified' do
-      let(:hash) do
-        { klass: Band, where: { name: 'Songs Ohia' } }
-      end
-
-      it 'returns a criteria' do
-        expect(criteria).to be_a(Mongoid::Criteria)
-      end
-
-      it 'sets the klass' do
-        expect(criteria.klass).to eq(Band)
-      end
-
-      it 'sets the selector' do
-        expect(criteria.selector).to eq({ 'name' => 'Songs Ohia' })
-      end
-    end
-
-    context 'when klass is missing' do
-      let(:hash) do
-        { where: { name: 'Songs Ohia' } }
-      end
-
-      it 'returns a criteria' do
-        expect(criteria).to be_a(Mongoid::Criteria)
-      end
-
-      it 'has klass nil' do
-        expect(criteria.klass).to be_nil
-      end
-
-      it 'sets the selector' do
-        expect(criteria.selector).to eq({ 'name' => 'Songs Ohia' })
-      end
-    end
-
-    context 'with allowed methods' do
-      context 'when using multiple query methods' do
-        let(:hash) do
-          {
-            klass: Band,
-            where: { active: true },
-            limit: 10,
-            skip: 5,
-            order_by: { name: 1 }
-          }
-        end
-
-        it 'applies all methods successfully' do
-          expect(criteria.selector).to eq({ 'active' => true })
-          expect(criteria.options[:limit]).to eq(10)
-          expect(criteria.options[:skip]).to eq(5)
-          expect(criteria.options[:sort]).to eq({ 'name' => 1 })
-        end
-      end
-
-      context 'when using query selector methods' do
-        let(:hash) do
-          {
-            klass: Band,
-            gt: { members: 2 },
-            in: { genre: ['rock', 'metal'] }
-          }
-        end
-
-        it 'applies selector methods' do
-          expect(criteria.selector['members']).to eq({ '$gt' => 2 })
-          expect(criteria.selector['genre']).to eq({ '$in' => ['rock', 'metal'] })
-        end
-      end
-
-      context 'when using aggregation methods' do
-        let(:hash) do
-          {
-            klass: Band,
-            project: { name: 1, members: 1 }
-          }
-        end
-
-        it 'applies aggregation methods' do
-          expect { criteria }.not_to raise_error
-        end
-      end
-    end
-
-    context 'with disallowed methods' do
-      context 'when attempting to call create' do
-        let(:hash) do
-          { klass: Band, create: { name: 'Malicious' } }
-        end
-
-        it 'raises ArgumentError' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'create' is not allowed in to_criteria")
-        end
-      end
-
-      context 'when attempting to call create!' do
-        let(:hash) do
-          { klass: Band, 'create!': { name: 'Malicious' } }
-        end
-
-        it 'raises ArgumentError' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'create!' is not allowed in to_criteria")
-        end
-      end
-
-      context 'when attempting to call build' do
-        let(:hash) do
-          { klass: Band, build: { name: 'Malicious' } }
-        end
-
-        it 'raises ArgumentError' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'build' is not allowed in to_criteria")
-        end
-      end
-
-      context 'when attempting to call find' do
-        let(:hash) do
-          { klass: Band, find: 'some_id' }
-        end
-
-        it 'raises ArgumentError' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'find' is not allowed in to_criteria")
-        end
-      end
-
-      context 'when attempting to call execute_or_raise' do
-        let(:hash) do
-          { klass: Band, execute_or_raise: ['id1', 'id2'] }
-        end
-
-        it 'raises ArgumentError' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'execute_or_raise' is not allowed in to_criteria")
-        end
-      end
-
-      context 'when attempting to call new' do
-        let(:hash) do
-          { klass: Band, new: { name: 'Test' } }
-        end
-
-        it 'raises ArgumentError' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'new' is not allowed in to_criteria")
-        end
-      end
-
-      context 'when allowed method is combined with disallowed method' do
-        let(:hash) do
-          {
-            klass: Band,
-            where: { active: true },
-            create: { name: 'Malicious' }
-          }
-        end
-
-        it 'raises ArgumentError before executing any methods' do
-          expect { criteria }.to raise_error(ArgumentError, "Method 'create' is not allowed in to_criteria")
-        end
-      end
-    end
-
-    context 'security validation' do
-      # This test ensures that ALL public methods not in the allowlist are blocked
-      it 'blocks all dangerous public methods' do
-        dangerous_methods = %i[
-          build create create! new
-          find find_or_create_by find_or_create_by! find_or_initialize_by
-          first_or_create first_or_create! first_or_initialize
-          execute_or_raise multiple_from_db for_ids
-          documents= inclusions= scoping_options=
-          initialize freeze as_json
-        ]
-
-        dangerous_methods.each do |method|
-          hash = { klass: Band, method => 'arg' }
-          expect { hash.to_criteria }.to raise_error(
-            ArgumentError,
-            "Method '#{method}' is not allowed in to_criteria"
-          ), "Expected method '#{method}' to be blocked but it was allowed"
-        end
-      end
-
-      it 'blocks dangerous inherited methods from Object' do
-        # Critical security test: block send, instance_eval, etc.
-        inherited_dangerous = %i[
-          send __send__ instance_eval instance_exec
-          instance_variable_set method
-        ]
-
-        inherited_dangerous.each do |method|
-          hash = { klass: Band, method => 'arg' }
-          expect { hash.to_criteria }.to raise_error(
-            ArgumentError,
-            "Method '#{method}' is not allowed in to_criteria"
-          ), "Expected inherited method '#{method}' to be blocked"
-        end
-      end
-
-      it 'blocks Enumerable execution methods' do
-        # to_criteria should build queries, not execute them
-        enumerable_methods = %i[each map select count sum]
-
-        enumerable_methods.each do |method|
-          hash = { klass: Band, method => 'arg' }
-          expect { hash.to_criteria }.to raise_error(
-            ArgumentError,
-            "Method '#{method}' is not allowed in to_criteria"
-          ), "Expected Enumerable method '#{method}' to be blocked"
-        end
-      end
-
-      it 'allows all whitelisted methods' do
-        # Sample of allowed methods from each category
-        allowed_sample = {
-          where: { name: 'Test' },      # Query selector
-          limit: 10,                     # Query option
-          skip: 5,                       # Query option
-          gt: { age: 18 },              # Query selector
-          in: { status: ['active'] },   # Query selector
-          ascending: :name,              # Sorting
-          includes: :notes,            # Eager loading
-          merge: { klass: Band },        # Merge
-        }
-
-        allowed_sample.each do |method, args|
-          hash = { klass: Band, method => args }
-          expect { hash.to_criteria }.not_to raise_error,
-            "Expected method '#{method}' to be allowed but it was blocked"
-        end
-      end
-    end
-  end
 end

data/spec/mongoid/extensions/integer_spec.rb

@@ -33,107 +33,86 @@ describe Mongoid::Extensions::Integer do
     end
   end
 
-  describe ".demongoize" do
+  [ :mongoize, :demongoize ].each do |method|
 
-    context "when the value is an integer" do
+    describe ".#{method}" do
 
-      it "returns a integer" do
-        expect(Integer.demongoize(number)).to eq(number)
-      end
-    end
+      context "when the value is a number" do
 
-    context "when the value is nil" do
-
-      it "returns nil" do
-        expect(Integer.demongoize(nil)).to be_nil
-      end
-    end
+        context "when the value is an integer" do
 
-    context "when the value is not an integer" do
+          context "when the value is small" do
 
-      it "converts the value to an integer" do
-        expect(Integer.demongoize("1.0")).to eq(1)
-      end
-    end
-  end
-
-  describe ".mongoize" do
-
-    context "when the value is a number" do
-
-      context "when the value is an integer" do
-
-        context "when the value is small" do
-
-          it "it returns the integer" do
-            expect(Integer.mongoize(3)).to eq(3)
+            it "it returns the integer" do
+              expect(Integer.send(method, 3)).to eq(3)
+            end
           end
-        end
 
-        context "when the value is large" do
+          context "when the value is large" do
 
-          it "returns the integer" do
-            expect(Integer.mongoize(1024**2).to_s).to eq("1048576")
+            it "returns the integer" do
+              expect(Integer.send(method, 1024**2).to_s).to eq("1048576")
+            end
           end
         end
-      end
 
-      context "when the value is a decimal" do
+        context "when the value is a decimal" do
 
-        it "casts to integer" do
-          expect(Integer.mongoize(2.5)).to eq(2)
+          it "casts to integer" do
+            expect(Integer.send(method, 2.5)).to eq(2)
+          end
         end
-      end
 
-      context "when the value is floating point zero" do
+        context "when the value is floating point zero" do
 
-        it "returns the integer zero" do
-          expect(Integer.mongoize(0.00000)).to eq(0)
+          it "returns the integer zero" do
+            expect(Integer.send(method, 0.00000)).to eq(0)
+          end
         end
-      end
 
-      context "when the value is a floating point integer" do
+        context "when the value is a floating point integer" do
 
-        it "returns the integer number" do
-          expect(Integer.mongoize(4.00000)).to eq(4)
+          it "returns the integer number" do
+            expect(Integer.send(method, 4.00000)).to eq(4)
+          end
         end
-      end
 
-      context "when the value has leading zeros" do
+        context "when the value has leading zeros" do
 
-        it "returns the stripped integer" do
-          expect(Integer.mongoize("000011")).to eq(11)
+          it "returns the stripped integer" do
+            expect(Integer.send(method, "000011")).to eq(11)
+          end
         end
       end
-    end
 
-    context "when the string is not a number" do
+      context "when the string is not a number" do
 
-      context "when the string is non numerical" do
+        context "when the string is non numerical" do
 
-        it "returns 0" do
-          expect(Integer.mongoize("foo")).to eq(0)
+          it "returns nil" do
+            expect(Integer.send(method, "foo")).to be_nil
+          end
         end
-      end
 
-      context "when the string is numerical" do
+        context "when the string is numerical" do
 
-        it "returns the integer value for the string" do
-          expect(Integer.mongoize("3")).to eq(3)
+          it "returns the integer value for the string" do
+            expect(Integer.send(method, "3")).to eq(3)
+          end
         end
-      end
 
-      context "when the string is empty" do
+        context "when the string is empty" do
 
-        it "returns nil" do
-          expect(Integer.mongoize("")).to be_nil
+          it "returns nil" do
+            expect(Integer.send(method, "")).to be_nil
+          end
         end
-      end
 
-      context "when the string is nil" do
+        context "when the string is nil" do
 
-        it "returns nil" do
-          expect(Integer.mongoize(nil)).to be_nil
+          it "returns nil" do
+            expect(Integer.send(method, nil)).to be_nil
+          end
         end
       end
     end