mongoid 8.1.11 → 8.1.13

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -822,6 +822,12 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
+              unless Mongoid.allow_unsafe_query_operators?
+                raise Errors::InvalidQuery,
+                      "String criteria are not allowed because they compile to the '$where' operator, " \
+                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
               js_query(criterion)
             else
               expr_query(criterion)
@@ -831,6 +837,19 @@ module Mongoid
 
         private
 
+        # Operators permitted at the top level of a query expression without
+        # opt-in. Excludes $where (JS execution) and other operators not needed
+        # for ordinary application queries.
+        ALLOWED_QUERY_OPERATORS = %w[
+          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
+        ].freeze
+
+        # Operators that execute server-side JavaScript. These are rejected at
+        # any depth, not just at the top level: the allowlist above permits
+        # $expr and the logical operators, and their values are arbitrary
+        # nested expressions that can carry $function or $where.
+        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -856,6 +875,8 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
+          # The operator guard is applied by _mongoid_expand_keys, which every
+          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
@@ -871,6 +892,94 @@ module Mongoid
           end
         end
 
+        # Enforces the operator rules governed by the
+        # +allow_unsafe_query_operators+ configuration option against a
+        # normalized query expression.
+        #
+        # Two rules apply, and both are skipped when the option is true:
+        #
+        # - An operator at the top level of the expression must appear in
+        #   ALLOWED_QUERY_OPERATORS.
+        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
+        #
+        # This is called from #_mongoid_expand_keys rather than from the
+        # individual query methods, because that is the one point every query
+        # method taking a user-supplied expression passes through on its way to
+        # the selector.
+        #
+        # It deliberately does not cover the APIs that ask for JavaScript
+        # outright, such as #js_query and Criteria#for_js: there the developer
+        # has chosen server-side JavaScript, so there is nothing to guard
+        # against. The same goes for the low-level Storable methods
+        # (#add_field_expression, #add_operator_expression), which write to the
+        # selector directly.
+        #
+        # @param [ Hash ] expr A normalized query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
+        #
+        # @api private
+        def _mongoid_validate_operators!(expr)
+          return if Mongoid.allow_unsafe_query_operators?
+
+          expr.each_key do |field|
+            field_s = field.to_s
+            next unless field_s.start_with?('$')
+            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
+
+            raise Errors::InvalidQuery,
+                  "Operator '#{field_s}' is not allowed in a query expression. " \
+                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
+          end
+
+          _mongoid_validate_no_javascript!(expr)
+        end
+
+        # Walks a query expression looking for operators that execute
+        # server-side JavaScript, descending through both hashes and arrays so
+        # that nested forms such as {'$expr' => {'$function' => ...}} and
+        # {'$or' => [ {'$where' => ...} ]} are caught.
+        #
+        # The walk does not distinguish operator position from value position,
+        # so it also rejects queries where a JavaScript operator name appears as
+        # data rather than as an operator. Server 5.0+ permits $-prefixed field
+        # names in stored documents, which makes this reachable:
+        #
+        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
+        #
+        # Here the $eq marks its argument as a literal value to compare, so the
+        # server never evaluates it, but the guard raises anyway. The only
+        # workaround today is the global allow_unsafe_query_operators flag.
+        #
+        # TODO: discuss whether to track operator position (skipping the subtree
+        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
+        # iteration. It removes the false positive but adds exactly the kind of
+        # state that a real bypass could hide in, so it was left out for now.
+        #
+        # @param [ Object ] object A fragment of a query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
+        #
+        # @api private
+        def _mongoid_validate_no_javascript!(object)
+          case object
+          when Hash
+            object.each do |key, value|
+              key_s = key.to_s
+              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
+                raise Errors::InvalidQuery,
+                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
+                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
+
+              _mongoid_validate_no_javascript!(value)
+            end
+          when Array
+            object.each { |value| _mongoid_validate_no_javascript!(value) }
+          end
+        end
+
         # Force the values of the criterion to be evolved.
         #
         # @api private

data/lib/mongoid/errors/in_memory_regexp_timeout.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when evaluating a query in memory exceeds
+    # Mongoid::Config.in_memory_regexp_time_limit.
+    #
+    # What the limit bounds depends on the Ruby in use. Where per-Regexp
+    # timeouts are available it is the time spent executing regular
+    # expressions; elsewhere it is the elapsed time of the whole in-memory
+    # evaluation. The message is worded to hold either way.
+    class InMemoryRegexpTimeout < MongoidError
+      # Create the new error.
+      #
+      # @example Create the new in-memory regexp timeout error.
+      #   InMemoryRegexpTimeout.new(5.0)
+      #
+      # @param [ Float ] limit The limit that was exceeded, in seconds. Not
+      #   always the configured one: a global Regexp.timeout stricter than the
+      #   configuration takes its place.
+      def initialize(limit)
+        super(compose_message('in_memory_regexp_timeout', limit: limit))
+      end
+    end
+  end
+end

data/lib/mongoid/errors.rb

@@ -10,6 +10,7 @@ require "mongoid/errors/document_not_found"
 require "mongoid/errors/empty_config_file"
 require "mongoid/errors/immutable_attribute"
 require "mongoid/errors/in_memory_collation_not_supported"
+require "mongoid/errors/in_memory_regexp_timeout"
 require "mongoid/errors/invalid_async_query_executor"
 require "mongoid/errors/invalid_collection"
 require "mongoid/errors/invalid_config_file"

data/lib/mongoid/extensions/hash.rb

@@ -167,6 +167,28 @@ module Mongoid
         true
       end
 
+      ALLOWED_TO_CRITERIA_METHODS = %i[
+        all all_in all_of and any_in any_of asc ascending
+        batch_size between
+        collation comment cursor_type
+        desc descending
+        elem_match eq exists extras
+        geo_spatial group gt gte
+        hint
+        in includes
+        limit lt lte
+        max_distance max_scan max_time_ms merge mod
+        ne near near_sphere nin no_timeout none none_of nor not not_in
+        offset only or order order_by
+        project
+        raw read reorder
+        scoped skip slice snapshot
+        text_search type
+        unscoped unwind
+        where with_size with_type without
+      ].freeze
+      private_constant :ALLOWED_TO_CRITERIA_METHODS
+
       # Convert this hash to a criteria. Will iterate over each keys in the
       # hash which must correspond to method on a criteria object. The hash
       # must also include a "klass" key.
@@ -178,7 +200,11 @@ module Mongoid
       def to_criteria
         criteria = Criteria.new(delete(:klass) || delete("klass"))
         each_pair do |method, args|
-          criteria = criteria.__send__(method, args)
+          method_sym = method.to_sym
+          unless ALLOWED_TO_CRITERIA_METHODS.include?(method_sym)
+            raise ArgumentError, "Method '#{method}' is not allowed in to_criteria"
+          end
+          criteria = criteria.public_send(method_sym, args)
         end
         criteria
       end

data/lib/mongoid/field_readable.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+module Mongoid
+  # Reads the value of a field name from a document without dispatching the
+  # name as an arbitrary method.
+  #
+  # Field names may come from application input, where a name like +destroy+
+  # or +attributes+ would delete the document or disclose its contents.
+  # Declared field and association names are validated when they are declared
+  # (see Mongoid.destructive_fields), so a name that resolves to one of them
+  # is safe to send to a document. Any other name is read from the attributes
+  # hash, which is what the database-backed query contexts do.
+  #
+  # @api private
+  module FieldReadable
+    private
+
+    # Read the value of the given field name from the given document.
+    #
+    # @param [ Document ] document The document to read from.
+    # @param [ String | Symbol ] name The name of the field.
+    #
+    # @return [ Object | nil ] The value of the field, or nil when the name
+    #   is neither a declared field nor present in the attributes.
+    def read_field_value(document, name)
+      name = name.to_s
+      # A blank name cannot name a field. Return nil, which is what reading
+      # one has always done.
+      return nil if name.blank?
+
+      if (meth = readable_method_for(document.class, name))
+        document.public_send(meth)
+      else
+        document.attributes[document.class.database_field_name(name)]
+      end
+    end
+
+    # Resolve the given name to a method that is declared by the given class,
+    # and therefore safe to send to one of its instances.
+    #
+    # @param [ Class ] klass The document class.
+    # @param [ String ] name The name of the field.
+    #
+    # @return [ String | nil ] The method to send, or nil when the name is
+    #   not declared by the class.
+    def readable_method_for(klass, name)
+      # Fields, associations, and field aliases each define a reader of their
+      # own name. Note that associations must be resolved before aliases: a
+      # belongs_to aliases its own name to its foreign key, and reading
+      # `band` must give the document, not the id.
+      return name if klass.relations.key?(name) ||
+                     klass.fields.key?(name) ||
+                     klass.aliased_fields.key?(name)
+
+      # An association may also be named by its `store_as`, which has no
+      # reader of its own, or by its ids accessor, which does.
+      if (assoc = klass.relations[klass.aliased_associations[name]])
+        return (assoc.store_as == name) ? assoc.name.to_s : name
+      end
+
+      # Localized fields also get a _translations reader, which does not
+      # appear in the fields hash.
+      base = name.delete_suffix(Fields::TRANSLATIONS_SFX)
+      return nil if base == name
+
+      name if klass.fields[klass.database_field_name(base)]&.localized?
+    end
+  end
+end

data/lib/mongoid/matchable.rb

@@ -17,7 +17,12 @@ module Mongoid
     #
     # @return [ true | false ] True if matches, false if not.
     def _matches?(selector)
-      Matcher::Expression.matches?(self, selector)
+      # Opens a regexp budget for this document only. Callers that match many
+      # documents against one selector open a budget of their own first, and
+      # this one joins it rather than giving every document a fresh limit.
+      Matcher::RegexpBudget.open(selector) do
+        Matcher::Expression.matches?(self, selector)
+      end
     end
   end
 end

data/lib/mongoid/matcher/eq_impl_with_regexp.rb

@@ -6,12 +6,10 @@ module Mongoid
     #
     # @api private
     module EqImplWithRegexp
-      module_function def matches?(original_operator, value, condition)
+      module_function def matches?(_original_operator, value, condition)
         case condition
-        when Regexp
-          value =~ condition
-        when ::BSON::Regexp::Raw
-          value =~ condition.compile
+        when Regexp, ::BSON::Regexp::Raw
+          value.respond_to?(:=~) && RegexpBudget.match?(value, condition)
         else
           if Mongoid.compare_time_by_ms &&
             value.kind_of?(Time) && condition.kind_of?(Time)

data/lib/mongoid/matcher/regex.rb

@@ -3,25 +3,24 @@ module Mongoid
 
     # @api private
     module Regex
-      module_function def matches?(exists, value, condition)
-        condition = case condition
-        when Regexp
-          condition
-        when BSON::Regexp::Raw
-          condition.compile
-        else
+      module_function def matches?(_exists, value, condition)
+        unless condition.is_a?(Regexp) || condition.is_a?(BSON::Regexp::Raw)
           # Note that strings must have been converted to a regular expression
           # instance already (with $options taken into account, if provided).
           raise Errors::InvalidQuery, "$regex requires a regular expression argument: #{Errors::InvalidQuery.truncate_expr(condition)}"
         end
 
+        # The condition is compiled by RegexpBudget rather than here, so that
+        # the budget's timeout can be baked into the pattern.
         case value
         when Array
+          # Object#=~ is gone as of Ruby 3.2, so an element that cannot be
+          # matched against has to be rejected rather than passed to =~.
           value.any? do |v|
-            v =~ condition
+            v.respond_to?(:=~) && RegexpBudget.match?(v, condition)
           end
         when String
-          value =~ condition
+          RegexpBudget.match?(value, condition)
         else
           false
         end