mongoid 8.1.11 → 8.1.13

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -35,6 +35,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
     it_behaves_like 'requires a non-nil argument'
 
     context "when provided a string" do
+      # String criteria compile to $where, which requires the opt-in.
+      config_override :allow_unsafe_query_operators, true
 
       let(:selection) do
         query.where("this.value = 10")
@@ -586,4 +588,237 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
+
+  describe 'top-level operator injection guard' do
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      context 'when passing $where' do
+        it 'does not raise' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'does not raise' do
+          expect do
+            query.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'does not raise' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing $function' do
+        it 'does not raise' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      context 'when passing $where' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      context 'when passing $function' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
+        end
+      end
+
+      context 'when the error mentions allow_unsafe_query_operators' do
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('$where' => 'true')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
+        context "when passing #{op} (allowlisted)" do
+          it 'does not raise' do
+            value = case op
+                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
+                    when '$text' then { '$search' => 'hi' }
+                    when '$expr' then { '$gt' => [ '$a', 1 ] }
+                    when '$jsonSchema' then { 'required' => [ 'x' ] }
+                    else true
+                    end
+            expect { query.where(op => value) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
+  describe 'nested operator injection guard' do
+    js = 'this.name == "admin"'
+
+    function_expr = {
+      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
+    }.freeze
+
+    accumulator_expr = {
+      '$accumulator' => {
+        'init' => 'function() { return 0; }',
+        'accumulate' => 'function() { return 0; }',
+        'accumulateArgs' => [],
+        'merge' => 'function() { return 0; }',
+        'lang' => 'js'
+      }
+    }.freeze
+
+    # Every path into the selector that does not route through #expr_query,
+    # plus the nested forms that a top-level key check cannot see.
+    unsafe_queries = {
+      'and with a $where key' => ->(query) { query.and('$where' => js) },
+      'or with a $where key' => ->(query) { query.or('$where' => js) },
+      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
+      'not with a $where key' => ->(query) { query.not('$where' => js) },
+      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
+      'none_of with a $where key' => ->(query) { query.none_of('$where' => js) },
+      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
+      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
+      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
+      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
+      'where with $where three levels deep' => lambda { |query|
+        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
+      },
+      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
+    }.freeze
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'raises InvalidQuery' do
+            expect do
+              builder.call(query)
+            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
+          end
+        end
+      end
+
+      it 'includes the config opt-in in the message' do
+        expect do
+          query.or('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+      end
+
+      context 'when the nested expression is safe' do
+        it 'permits $or with field expressions' do
+          expect do
+            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
+          end.not_to raise_error
+        end
+
+        it 'permits $expr with aggregation operators' do
+          expect do
+            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
+          end.not_to raise_error
+        end
+
+        it 'permits a field whose name resembles a javascript operator' do
+          expect do
+            query.where('where' => js)
+          end.not_to raise_error
+        end
+
+        it 'permits a value that resembles a javascript operator' do
+          expect do
+            query.where('name' => '$where')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'does not raise' do
+            expect { builder.call(query) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
+  describe 'operator guard on chained override methods' do
+    # On this branch overwrite_chained_operators defaults to false, which
+    # routes elem_match through the guarded and_with_operator funnel. Force
+    # the override path so the guard in Mergeable#__override__ is exercised.
+    config_override :overwrite_chained_operators, true
+
+    let(:js) { 'this.name == "admin"' }
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      it 'rejects a $where nested in elem_match' do
+        expect do
+          query.elem_match(a: { '$where' => js })
+        end.to raise_error(Mongoid::Errors::InvalidQuery, /executes server-side JavaScript/)
+      end
+
+      it 'permits an ordinary elem_match value' do
+        expect do
+          query.elem_match(a: { name: 'x' })
+        end.not_to raise_error
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      it 'permits a $where nested in elem_match' do
+        expect do
+          query.elem_match(a: { '$where' => js })
+        end.not_to raise_error
+      end
+    end
+  end
 end

data/spec/mongoid/criteria_spec.rb

@@ -2659,6 +2659,8 @@ describe Mongoid::Criteria do
       end
 
       context "when the criteria is not embedded" do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:criteria) do
           Band.where("this.name == 'Depeche Mode'")

data/spec/mongoid/extensions/hash_spec.rb

@@ -497,4 +497,240 @@ describe Mongoid::Extensions::Hash do
 
     it_behaves_like 'unsatisfiable criteria method'
   end
+
+  describe '#to_criteria' do
+    subject(:criteria) { hash.to_criteria }
+
+    context 'when klass is specified' do
+      let(:hash) do
+        { klass: Band, where: { name: 'Songs Ohia' } }
+      end
+
+      it 'returns a criteria' do
+        expect(criteria).to be_a(Mongoid::Criteria)
+      end
+
+      it 'sets the klass' do
+        expect(criteria.klass).to eq(Band)
+      end
+
+      it 'sets the selector' do
+        expect(criteria.selector).to eq({ 'name' => 'Songs Ohia' })
+      end
+    end
+
+    context 'when klass is missing' do
+      let(:hash) do
+        { where: { name: 'Songs Ohia' } }
+      end
+
+      it 'returns a criteria' do
+        expect(criteria).to be_a(Mongoid::Criteria)
+      end
+
+      it 'has klass nil' do
+        expect(criteria.klass).to be_nil
+      end
+
+      it 'sets the selector' do
+        expect(criteria.selector).to eq({ 'name' => 'Songs Ohia' })
+      end
+    end
+
+    context 'with allowed methods' do
+      context 'when using multiple query methods' do
+        let(:hash) do
+          {
+            klass: Band,
+            where: { active: true },
+            limit: 10,
+            skip: 5,
+            order_by: { name: 1 }
+          }
+        end
+
+        it 'applies all methods successfully' do
+          expect(criteria.selector).to eq({ 'active' => true })
+          expect(criteria.options[:limit]).to eq(10)
+          expect(criteria.options[:skip]).to eq(5)
+          expect(criteria.options[:sort]).to eq({ 'name' => 1 })
+        end
+      end
+
+      context 'when using query selector methods' do
+        let(:hash) do
+          {
+            klass: Band,
+            gt: { members: 2 },
+            in: { genre: ['rock', 'metal'] }
+          }
+        end
+
+        it 'applies selector methods' do
+          expect(criteria.selector['members']).to eq({ '$gt' => 2 })
+          expect(criteria.selector['genre']).to eq({ '$in' => ['rock', 'metal'] })
+        end
+      end
+
+      context 'when using aggregation methods' do
+        let(:hash) do
+          {
+            klass: Band,
+            project: { name: 1, members: 1 }
+          }
+        end
+
+        it 'applies aggregation methods' do
+          expect { criteria }.not_to raise_error
+        end
+      end
+    end
+
+    context 'with disallowed methods' do
+      context 'when attempting to call create' do
+        let(:hash) do
+          { klass: Band, create: { name: 'Malicious' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'create' is not allowed in to_criteria")
+        end
+      end
+
+      context 'when attempting to call create!' do
+        let(:hash) do
+          { klass: Band, 'create!': { name: 'Malicious' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'create!' is not allowed in to_criteria")
+        end
+      end
+
+      context 'when attempting to call build' do
+        let(:hash) do
+          { klass: Band, build: { name: 'Malicious' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'build' is not allowed in to_criteria")
+        end
+      end
+
+      context 'when attempting to call find' do
+        let(:hash) do
+          { klass: Band, find: 'some_id' }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'find' is not allowed in to_criteria")
+        end
+      end
+
+      context 'when attempting to call execute_or_raise' do
+        let(:hash) do
+          { klass: Band, execute_or_raise: ['id1', 'id2'] }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'execute_or_raise' is not allowed in to_criteria")
+        end
+      end
+
+      context 'when attempting to call new' do
+        let(:hash) do
+          { klass: Band, new: { name: 'Test' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'new' is not allowed in to_criteria")
+        end
+      end
+
+      context 'when allowed method is combined with disallowed method' do
+        let(:hash) do
+          {
+            klass: Band,
+            where: { active: true },
+            create: { name: 'Malicious' }
+          }
+        end
+
+        it 'raises ArgumentError before executing any methods' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'create' is not allowed in to_criteria")
+        end
+      end
+    end
+
+    context 'security validation' do
+      # This test ensures that ALL public methods not in the allowlist are blocked
+      it 'blocks all dangerous public methods' do
+        dangerous_methods = %i[
+          build create create! new
+          find find_or_create_by find_or_create_by! find_or_initialize_by
+          first_or_create first_or_create! first_or_initialize
+          execute_or_raise multiple_from_db for_ids
+          documents= inclusions= scoping_options=
+          initialize freeze as_json
+        ]
+
+        dangerous_methods.each do |method|
+          hash = { klass: Band, method => 'arg' }
+          expect { hash.to_criteria }.to raise_error(
+            ArgumentError,
+            "Method '#{method}' is not allowed in to_criteria"
+          ), "Expected method '#{method}' to be blocked but it was allowed"
+        end
+      end
+
+      it 'blocks dangerous inherited methods from Object' do
+        # Critical security test: block send, instance_eval, etc.
+        inherited_dangerous = %i[
+          send __send__ instance_eval instance_exec
+          instance_variable_set method
+        ]
+
+        inherited_dangerous.each do |method|
+          hash = { klass: Band, method => 'arg' }
+          expect { hash.to_criteria }.to raise_error(
+            ArgumentError,
+            "Method '#{method}' is not allowed in to_criteria"
+          ), "Expected inherited method '#{method}' to be blocked"
+        end
+      end
+
+      it 'blocks Enumerable execution methods' do
+        # to_criteria should build queries, not execute them
+        enumerable_methods = %i[each map select count sum]
+
+        enumerable_methods.each do |method|
+          hash = { klass: Band, method => 'arg' }
+          expect { hash.to_criteria }.to raise_error(
+            ArgumentError,
+            "Method '#{method}' is not allowed in to_criteria"
+          ), "Expected Enumerable method '#{method}' to be blocked"
+        end
+      end
+
+      it 'allows all whitelisted methods' do
+        # Sample of allowed methods from each category
+        allowed_sample = {
+          where: { name: 'Test' },      # Query selector
+          limit: 10,                     # Query option
+          skip: 5,                       # Query option
+          gt: { age: 18 },              # Query selector
+          in: { status: ['active'] },   # Query selector
+          ascending: :name,              # Sorting
+          includes: :notes,            # Eager loading
+          merge: { klass: Band },        # Merge
+        }
+
+        allowed_sample.each do |method, args|
+          hash = { klass: Band, method => args }
+          expect { hash.to_criteria }.not_to raise_error,
+            "Expected method '#{method}' to be allowed but it was blocked"
+        end
+      end
+    end
+  end
 end