mongoid 8.0.11 → 8.0.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 78040726b40c1709f9218bc28850b802cf5aedfbdd178c2ed90322ffb16ba0ee
-  data.tar.gz: 438d1fee26567d71150518c5df2f764d6671c49ea6cc02c0582a7cd15e80fd7a
+  metadata.gz: a9945b53ebb2236e5b44ef4cfead09b790b3b00881f62dba5c7007c1d99fdcba
+  data.tar.gz: f092a211395767e35a20bd2492e9c9be56c3bc53721bb6e8b437c0ef4d4c3111
 SHA512:
-  metadata.gz: 8420a185b4baf6c1183ff188bc16f5d79fc75f44f1784c37df163836b70939250efbefceaeb53269a9d97f0b7bc9ae997a6586306223bea424db8738a3f2513e
-  data.tar.gz: 1f8dc137d3de2c5bc6ff676f8330471e4a792fe259839e6edec6107e145fd3b81bd4013df64e4b2410a62793ce2d35855069672a4a8784cf2de076f3ac4fda61
+  metadata.gz: 7fa47f5a3a012f20238d7813bc173c3a22b0f96e493bb391fc5d5d4cb5ffc37d50bd27959f2fa871f11b402ef739d43ab3ff044a7cd256ef4531b340bf1f882d
+  data.tar.gz: 8bf1abb2f757cb18b92ccfae1214a7d19c6d6331e2ed30a4a39068eab365e8cf4cd0fc017810029106a4823ddb8a8a416a63de4faa334332e012f403167b7351

data/lib/config/locales/en.yml

@@ -105,6 +105,32 @@ en:
             A collation option is only supported if the query is executed on a MongoDB server
             with version >= 3.4."
           resolution: "Remove the collation option from the query."
+        in_memory_regexp_timeout:
+          message: "Evaluating this query in memory exceeded the %{limit} second
+            limit that applies to conditions containing a regular expression."
+          summary: "Mongoid evaluates some conditions in the calling thread
+            rather than sending them to the server: queries against an embedded
+            association, removing documents from an association by condition,
+            and Document#_matches?. A regular expression in such a condition
+            runs locally. Mongoid limits the total time one in-memory
+            evaluation may spend matching, because both the cost of a single
+            match and the number of matches performed grow with the condition,
+            and a pattern built from end-user input can be made to consume an
+            unbounded amount of CPU. The limit is cumulative over the whole
+            evaluation rather than per match. Where the Ruby in use offers no
+            per-Regexp timeout the limit is enforced as wall clock over the
+            whole in-memory evaluation, so there it can be exceeded by a large
+            scan even when the pattern itself is cheap."
+          resolution: "Check whether the pattern in this query comes from user
+            input; if it does, validate it before querying. If the query is
+            legitimate and simply large, raise
+            Mongoid::Config.in_memory_regexp_time_limit, or set it to nil to
+            remove the limit entirely. The limit in force is the smaller of
+            that setting and any global Regexp.timeout the application has set,
+            so check both. On JRuby, and on MRI before 3.2, there is no
+            per-Regexp timeout, so what the limit bounds there is the elapsed
+            time of the whole in-memory evaluation rather than the time spent
+            matching."
         invalid_config_file:
           message: "Invalid configuration file: %{path}."
           summary: "Your mongoid.yml configuration file does not contain the

data/lib/mongoid/association/depending.rb

@@ -11,11 +11,15 @@ module Mongoid
       included do
         class_attribute :dependents
 
+        # Note the leading underscore: without it, ActiveSupport's
+        # class_attribute would generate a helper method for this attribute
+        # that collides with one it generates for :dependents.
+        #
         # @api private
-        class_attribute :dependents_owner
+        class_attribute :_dependents_owner
 
         self.dependents = []
-        self.dependents_owner = self
+        self._dependents_owner = self
       end
 
       class_methods do
@@ -50,9 +54,9 @@ module Mongoid
       def self.define_dependency!(association)
         validate!(association)
         association.inverse_class.tap do |klass|
-          if klass.dependents_owner != klass
+          if klass._dependents_owner != klass
             klass.dependents = []
-            klass.dependents_owner = klass
+            klass._dependents_owner = klass
           end
 
           if association.dependent && !klass.dependents.include?(association)

data/lib/mongoid/association/nested/many.rb

@@ -169,7 +169,7 @@ module Mongoid
         # @param [ Hash ] attrs The single document attributes to process.
         def update_nested_relation(parent, id, attrs)
           first = existing.first
-          converted = first ? convert_id(first.class, id) : id
+          converted = convert_id(first ? first.class : association.klass, id)
 
           if existing.where(_id: converted).exists?
             # document exists in association
@@ -179,11 +179,46 @@ module Mongoid
             else
               update_document(doc, attrs)
             end
-          else
+          elsif association.embedded?
+            raise Errors::DocumentNotFound.new(association.klass, id)
+          elsif destroyable?(attrs)
+            # A destroy of a document that is not in the association is
+            # ignored, rather than reaching for it outside the association.
+            nil
+          elsif Mongoid.allow_reparenting_via_nested_attributes?
+            Mongoid::Warnings.warn_reparenting_via_nested_attributes
+
             # push existing document to association
             doc = association.klass.unscoped.find(converted)
+            # find returns nil instead of raising when
+            # Mongoid.raise_not_found_error is false; a missing document
+            # must still be an error here, consistent with the other
+            # not-found branches.
+            raise Errors::DocumentNotFound.new(association.klass, id) if doc.nil?
+
             update_document(doc, attrs)
-            existing.push(doc) unless destroyable?(attrs)
+            existing.push(doc)
+          else
+            raise Errors::DocumentNotFound.new(association.klass, not_found_params(parent, id))
+          end
+        end
+
+        # The params to report when an id in the nested attributes could not
+        # be resolved within the association.
+        #
+        # @api private
+        #
+        # @param [ Document ] parent The parent document.
+        # @param [ String | BSON::ObjectId ] id of the related document.
+        #
+        # @return [ Hash | Object ] The params for the not found error.
+        def not_found_params(parent, id)
+          if association.is_a?(Association::Referenced::HasAndBelongsToMany)
+            # A many-to-many association has no foreign key on the child, so
+            # the id is only ever resolved within the association itself.
+            id
+          else
+            { _id: id, association.foreign_key => parent.id }
           end
         end
       end

data/lib/mongoid/association/nested/nested_buildable.rb

@@ -53,12 +53,26 @@ module Mongoid
         # @example Convert the id.
         #   builder.convert_id(Person, "4d371b444835d98b8b000010")
         #
+        # Ids arriving from a form are always scalars. A Hash or an Array
+        # here means the parameters were crafted, and letting one through
+        # would turn the id into a query operator, so they are rejected.
+        #
         # @param [ Class ] klass The class we're trying to convert for.
         # @param [ String ] id The id, usually coming from the form.
         #
         # @return [ BSON::ObjectId | String | Object ] The converted id.
+        #
+        # @raise [ Errors::DocumentNotFound ] if the id is not a scalar, or
+        #   cannot be converted to the type the class uses for its ids.
+        #   The BSON::Error rescue is defensive: a value that reaches
+        #   BSON::ObjectId.mongoize and raises there must not surface as an
+        #   unhandled BSON error in the caller.
         def convert_id(klass, id)
+          raise Errors::DocumentNotFound.new(klass, id) if id.is_a?(::Hash) || id.is_a?(::Array)
+
           klass.using_object_ids? ? BSON::ObjectId.mongoize(id) : id
+        rescue BSON::Error
+          raise Errors::DocumentNotFound.new(klass, id)
         end
       end
     end

data/lib/mongoid/association/referenced/has_many/proxy.rb

@@ -477,12 +477,111 @@ module Mongoid
           # @return [ Integer ] The number of documents deleted.
           def remove_all(conditions = nil, method = :delete_all)
             selector = conditions || {}
-            removed = klass.send(method, selector.merge!(criteria.selector))
+            selector.merge!(criteria.selector)
+
+            # Scanning before the delete means scanning only what is already in
+            # memory, so it is only done where there is a pattern whose cost has
+            # to be bounded. Everywhere else the delete comes first and the scan
+            # sees the survivors, which is what this association has always
+            # done.
+            #
+            # The limit is read once and carried into whichever branch is taken.
+            # Letting the branch below ask again would read it a second time,
+            # across a server round trip, and a limit that had become positive
+            # in the meantime would put a deadline on the delete_if -- a query,
+            # and an unbind of every match -- which is the arrangement this
+            # branch exists to avoid.
+            limit = Matcher::RegexpBudget.limit_for(selector)
+            return remove_all_bounded(selector, method, limit) if limit
+
+            removed = klass.send(method, selector)
+
+            # No scope around this. The scan runs after the delete, so the
+            # association this loads comes back holding only what the delete did
+            # not match, and there is no pattern here to bound in any case.
+            # Opening a scope would save _matches? from deciding once per
+            # document -- 0.48us against 1.74us for the match itself -- but a
+            # scope with nothing to bound suppresses that decision for
+            # everything nested inside it, and loading the association runs
+            # find callbacks. A pattern in a selector one of those evaluates
+            # would go unguarded, which costs more than the saving is worth on a
+            # path that has just made two round trips.
             _target.delete_if do |doc|
               doc._matches?(selector).tap do |b|
                 unbind_one(doc) if b
               end
             end
+
+            removed
+          end
+
+          # Deletes all related documents matching a selector that carries a
+          # regular expression, with the whole scan under one regexp budget.
+          #
+          # The scan runs before anything is deleted, so a budget that runs out
+          # leaves both the database and the association untouched rather than
+          # reporting a failure for a delete that has already happened. It also
+          # means the budget is closed by the time the association is mutated,
+          # so where the budget is enforced with Timeout there is no window for
+          # the exception to land in the middle of an unbind.
+          #
+          # @param [ Hash ] selector The selector to delete with.
+          # @param [ Symbol ] method The deletion method to call.
+          # @param [ Float ] limit The seconds the scan may spend, as read by
+          #   the caller when it chose this path.
+          #
+          # @return [ Integer ] The number of documents deleted.
+          def remove_all_bounded(selector, method, limit)
+            # Only what the association already holds. Iterating it instead
+            # would load the whole association before the delete, and for a
+            # broad pattern that is every document the association has: /.*/ is
+            # both the cheapest pattern an attacker can supply and the one that
+            # matches everything, so bounding the cost of the matching would
+            # have been paid for with an unbounded amount of memory. Nothing is
+            # missed by not loading, because the server evaluates the same
+            # selector for the delete itself.
+            #
+            # It also means the scan runs no query, so no deadline of ours can
+            # land on one. Where the budget is enforced with Timeout, covering
+            # a query would report a slow network as a regexp timeout and could
+            # deliver the asynchronous exception inside the driver's socket
+            # read.
+            documents = _target.in_memory
+
+            matching = Matcher::RegexpBudget.open_with(limit) do
+              documents.select { |doc| doc._matches?(selector) }
+            end
+
+            removed = klass.send(method, selector)
+
+            # The ids are already known to be in memory, so the loaded and added
+            # documents can be dropped directly. Enumerable#delete would look
+            # each one up by id and stop at the first hash that has it, which
+            # removes the wrong instance when both hashes hold one for the same
+            # id. Enumerable#delete_if drops it from both, as this does, but
+            # only after load_all!, which is the load this scan exists to avoid.
+            #
+            # Which documents get unbound has always depended on which ones
+            # happened to be in memory, and scanning only what is in memory
+            # keeps that. It matters for has_and_belongs_to_many, whose
+            # unbind_one pulls the id out of the foreign key array on _base and
+            # marks it dirty; the scan used to run after the delete, against an
+            # association that a cold proxy had just reloaded as holding only
+            # the survivors, so nothing matched and nothing was unbound.
+            #
+            # TODO: unbinding should not depend on what was in memory. Every
+            # matched document leaves the association, so every one of them
+            # should be unbound, which would also stop _base's foreign key
+            # array from keeping ids that no longer resolve. That is a
+            # behaviour change for has_and_belongs_to_many and belongs in a
+            # ticket of its own, with a release note; it should not ride along
+            # on this one.
+            matching.each do |doc|
+              unbind_one(doc)
+              _target._loaded.delete(doc._id)
+              _target._added.delete(doc._id)
+            end
+
             removed
           end
 

data/lib/mongoid/clients/factory.rb

@@ -95,6 +95,10 @@ module Mongoid
             [MONGOID_WRAPPING_LIBRARY] + options[:wrapping_libraries]
           else
             [MONGOID_WRAPPING_LIBRARY]
+          end.tap do |wrap|
+            if defined?(::Rails) && ::Rails.respond_to?(:version)
+              wrap << { name: 'Rails', version: ::Rails.version }
+            end
           end
           options[:wrapping_libraries] = wrap_lib
         end

data/lib/mongoid/config.rb

@@ -165,6 +165,68 @@ module Mongoid
     # See https://jira.mongodb.org/browse/MONGOID-5658 for more details.
     option :around_callbacks_for_embeds, default: true
 
+    # The maximum number of seconds that evaluating a single query in memory
+    # may spend executing regular expressions. Queries against an embedded
+    # association are evaluated in the calling thread, so a pattern built from
+    # user input runs locally and can otherwise consume unbounded CPU. The
+    # limit is cumulative over the whole query, since cost grows with the
+    # number of documents and conditions as well as with the pattern.
+    #
+    # Set to nil to remove the limit. On Ruby 3.2 and later the remaining
+    # budget is compiled into the pattern, so the limit counts only the time
+    # spent matching. Earlier Rubies have no per-Regexp timeout, so the query
+    # is bounded with Timeout instead and the limit is wall clock over the
+    # whole in-memory evaluation.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5981 for details.
+    option :in_memory_regexp_time_limit, default: 5.0
+
+    # When false (default), query operators are restricted when building a
+    # selector, so that user-supplied input reaching the query builder cannot
+    # make MongoDB execute arbitrary JavaScript. Two rules are enforced:
+    #
+    # - An operator at the top level of an expression must appear in
+    #   +Criteria::Queryable::Selectable::ALLOWED_QUERY_OPERATORS+.
+    # - +$where+, +$function+, and +$accumulator+ are rejected at any depth,
+    #   including inside +$expr+ and the logical operators.
+    #
+    # This applies to every query method that accepts an expression, including
+    # +where+, +find_by+, +and+, +or+, +nor+, +not+, +any_of+, and +none_of+.
+    # It also governs the string form of +where+, e.g.
+    # +where("this.name == 'admin'")+, which the server evaluates as +$where+.
+    # Applications relying on that form must set this option to true.
+    #
+    # The APIs that request JavaScript explicitly, +Criteria#for_js+ and
+    # +js_query+, are unaffected: there the developer has asked for it.
+    #
+    # Set to true to restore the unrestricted pass-through behavior.
+    #
+    # Note that this option is deliberately not tied to +load_defaults+: an
+    # application that has opted into older defaults still gets the guard, and
+    # must set this option explicitly to turn it off.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5939,
+    # https://jira.mongodb.org/browse/MONGOID-5993,
+    # https://jira.mongodb.org/browse/MONGOID-5994 for details.
+    option :allow_unsafe_query_operators, default: false
+
+    # When this flag is true, it will be possible to add a record to a
+    # "has_many" or "has_and_belongs_to_many" association by passing that
+    # record's id in the nested attributes for another parent record, even
+    # when the record does not already belong to that association. For a
+    # "has_many" association this moves the record to the new parent.
+    #
+    # When this flag is false, an id in nested attributes is only resolved
+    # within the association itself, and anything else raises an error.
+    #
+    # The default is `false`. Note that allowing reparenting via nested attributes
+    # is a potential security risk, since it could allow a malicious user to move
+    # records that they do not own to a parent record that they do own.
+    #
+    # This option will be removed in Mongoid 10, and the only behavior will be
+    # as if this option were set to false.
+    option :allow_reparenting_via_nested_attributes, default: false
+
     # Has Mongoid been configured? This is checking that at least a valid
     # client config exists.
     #

data/lib/mongoid/contextual/aggregable/memory.rb

@@ -1,10 +1,13 @@
 # frozen_string_literal: true
 
+require 'mongoid/field_readable'
+
 module Mongoid
   module Contextual
     module Aggregable
       # Contains behavior for aggregating values in memory.
       module Memory
+        include FieldReadable
 
         # Get all the aggregate values for the provided field.
         # Provided for interface consistency with Aggregable::Mongo.
@@ -29,7 +32,7 @@ module Mongoid
         #
         # @return [ Numeric ] The average.
         def avg(field)
-          total = count { |doc| !doc.send(field).nil? }
+          total = count { |doc| !read_field_value(doc, field).nil? }
           return nil unless total > 0
 
           total = total.to_f if total.is_a?(Integer)
@@ -114,7 +117,7 @@ module Mongoid
         def aggregate_by(field, method)
           return nil unless any?
 
-          map { |doc| doc.public_send(field) }.compact.public_send(method)
+          map { |doc| read_field_value(doc, field) }.compact.public_send(method)
         end
       end
     end

data/lib/mongoid/contextual/memory.rb

@@ -2,6 +2,7 @@
 
 require "mongoid/contextual/aggregable/memory"
 require "mongoid/association/eager_loadable"
+require "mongoid/field_readable"
 
 module Mongoid
   module Contextual
@@ -11,6 +12,7 @@ module Mongoid
       include Association::EagerLoadable
       include Queryable
       include Positional
+      include FieldReadable
 
       # @attribute [r] root The root document.
       # @attribute [r] path The atomic path.
@@ -141,10 +143,20 @@ module Mongoid
       # @param [ Criteria ] criteria The criteria.
       def initialize(criteria)
         @criteria, @klass = criteria, criteria.klass
-        @documents = criteria.documents.select do |doc|
-          @root ||= doc._root
-          @collection ||= root.collection
-          doc._matches?(criteria.selector)
+
+        # Resolving the collection can build a Mongo::Client the first time it
+        # runs, so it happens before the budget opens. Where the budget is
+        # enforced with Timeout the exception is asynchronous, and landing in
+        # the middle of that would leave a half-built client behind.
+        if (first = criteria.documents.first)
+          @root = first._root
+          @collection = @root.collection
+        end
+
+        # One regexp budget covers the whole scan, so that the limit bounds the
+        # query rather than each document individually.
+        @documents = Matcher::RegexpBudget.open(criteria.selector) do
+          criteria.documents.select { |doc| doc._matches?(criteria.selector) }
         end
         apply_sorting
         apply_options
@@ -534,11 +546,10 @@ module Mongoid
             # _translations hash so that we can get the specified translation in
             # the remaining
             if field&.localized?
-              document.send("#{segment}_translations")
+              document.public_send("#{segment}_translations")
             end
           end
-          meth = klass.aliased_associations[segment] || segment
-          res.nil? ? document.try(meth) : res
+          res.nil? ? read_field_value(document, segment) : res
         elsif document.is_a?(Hash)
           # TODO: Remove the indifferent access when implementing MONGOID-5410.
           document.key?(segment.to_s) ?

data/lib/mongoid/criteria/queryable/mergeable.rb

@@ -325,6 +325,10 @@ module Mongoid
               end
             end
           end
+          # Every query method that takes a user-supplied expression normalizes
+          # it here, so this is where the operator guard is enforced. See
+          # Selectable#_mongoid_validate_operators! for what it does not cover.
+          _mongoid_validate_operators!(result)
           result
         end
 
@@ -343,6 +347,14 @@ module Mongoid
           if criterion.is_a?(Selectable)
             criterion = criterion.selector
           end
+
+          # The __override__ path writes to the selector directly, so it
+          # bypasses _mongoid_expand_keys where the operator guard normally
+          # runs. Enforce the guard here so chained override methods
+          # (elem_match, exists, eq, gt, in, etc.) cannot smuggle $where or
+          # other JavaScript operators under strict mode.
+          _mongoid_validate_operators!(criterion)
+
           selection(criterion) do |selector, field, value|
             expression = prepare(field, operator, value)
             existing = selector[field]

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -791,6 +791,12 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
+              unless Mongoid.allow_unsafe_query_operators?
+                raise Errors::InvalidQuery,
+                      "String criteria are not allowed because they compile to the '$where' operator, " \
+                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
               js_query(criterion)
             else
               expr_query(criterion)
@@ -800,6 +806,19 @@ module Mongoid
 
         private
 
+        # Operators permitted at the top level of a query expression without
+        # opt-in. Excludes $where (JS execution) and other operators not needed
+        # for ordinary application queries.
+        ALLOWED_QUERY_OPERATORS = %w[
+          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
+        ].freeze
+
+        # Operators that execute server-side JavaScript. These are rejected at
+        # any depth, not just at the top level: the allowlist above permits
+        # $expr and the logical operators, and their values are arbitrary
+        # nested expressions that can carry $function or $where.
+        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -825,6 +844,8 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
+          # The operator guard is applied by _mongoid_expand_keys, which every
+          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
@@ -840,6 +861,94 @@ module Mongoid
           end
         end
 
+        # Enforces the operator rules governed by the
+        # +allow_unsafe_query_operators+ configuration option against a
+        # normalized query expression.
+        #
+        # Two rules apply, and both are skipped when the option is true:
+        #
+        # - An operator at the top level of the expression must appear in
+        #   ALLOWED_QUERY_OPERATORS.
+        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
+        #
+        # This is called from #_mongoid_expand_keys rather than from the
+        # individual query methods, because that is the one point every query
+        # method taking a user-supplied expression passes through on its way to
+        # the selector.
+        #
+        # It deliberately does not cover the APIs that ask for JavaScript
+        # outright, such as #js_query and Criteria#for_js: there the developer
+        # has chosen server-side JavaScript, so there is nothing to guard
+        # against. The same goes for the low-level Storable methods
+        # (#add_field_expression, #add_operator_expression), which write to the
+        # selector directly.
+        #
+        # @param [ Hash ] expr A normalized query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
+        #
+        # @api private
+        def _mongoid_validate_operators!(expr)
+          return if Mongoid.allow_unsafe_query_operators?
+
+          expr.each_key do |field|
+            field_s = field.to_s
+            next unless field_s.start_with?('$')
+            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
+
+            raise Errors::InvalidQuery,
+                  "Operator '#{field_s}' is not allowed in a query expression. " \
+                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
+          end
+
+          _mongoid_validate_no_javascript!(expr)
+        end
+
+        # Walks a query expression looking for operators that execute
+        # server-side JavaScript, descending through both hashes and arrays so
+        # that nested forms such as {'$expr' => {'$function' => ...}} and
+        # {'$or' => [ {'$where' => ...} ]} are caught.
+        #
+        # The walk does not distinguish operator position from value position,
+        # so it also rejects queries where a JavaScript operator name appears as
+        # data rather than as an operator. Server 5.0+ permits $-prefixed field
+        # names in stored documents, which makes this reachable:
+        #
+        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
+        #
+        # Here the $eq marks its argument as a literal value to compare, so the
+        # server never evaluates it, but the guard raises anyway. The only
+        # workaround today is the global allow_unsafe_query_operators flag.
+        #
+        # TODO: discuss whether to track operator position (skipping the subtree
+        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
+        # iteration. It removes the false positive but adds exactly the kind of
+        # state that a real bypass could hide in, so it was left out for now.
+        #
+        # @param [ Object ] object A fragment of a query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
+        #
+        # @api private
+        def _mongoid_validate_no_javascript!(object)
+          case object
+          when Hash
+            object.each do |key, value|
+              key_s = key.to_s
+              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
+                raise Errors::InvalidQuery,
+                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
+                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
+
+              _mongoid_validate_no_javascript!(value)
+            end
+          when Array
+            object.each { |value| _mongoid_validate_no_javascript!(value) }
+          end
+        end
+
         # Force the values of the criterion to be evolved.
         #
         # @api private

data/lib/mongoid/errors/in_memory_regexp_timeout.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when evaluating a query in memory exceeds
+    # Mongoid::Config.in_memory_regexp_time_limit.
+    #
+    # What the limit bounds depends on the Ruby in use. Where per-Regexp
+    # timeouts are available it is the time spent executing regular
+    # expressions; elsewhere it is the elapsed time of the whole in-memory
+    # evaluation. The message is worded to hold either way.
+    class InMemoryRegexpTimeout < MongoidError
+      # Create the new error.
+      #
+      # @example Create the new in-memory regexp timeout error.
+      #   InMemoryRegexpTimeout.new(5.0)
+      #
+      # @param [ Float ] limit The limit that was exceeded, in seconds. Not
+      #   always the configured one: a global Regexp.timeout stricter than the
+      #   configuration takes its place.
+      def initialize(limit)
+        super(compose_message('in_memory_regexp_timeout', limit: limit))
+      end
+    end
+  end
+end

data/lib/mongoid/errors.rb

@@ -8,6 +8,7 @@ require "mongoid/errors/document_not_destroyed"
 require "mongoid/errors/document_not_found"
 require "mongoid/errors/empty_config_file"
 require "mongoid/errors/in_memory_collation_not_supported"
+require "mongoid/errors/in_memory_regexp_timeout"
 require "mongoid/errors/invalid_collection"
 require "mongoid/errors/invalid_config_file"
 require "mongoid/errors/invalid_config_option"