mongoid 9.0.10 → 9.0.12

data/lib/mongoid/config.rb

@@ -110,6 +110,33 @@ module Mongoid
     # to `:global_thread_pool`.
     option :global_executor_concurrency, default: nil
 
+    # When this flag is true, it will be possible to add a record to a
+    # "has_many" or "has_and_belongs_to_many" association by passing that
+    # record's id in the nested attributes for another parent record, even
+    # when the record does not already belong to that association. For a
+    # "has_many" association this moves the record to the new parent.
+    #
+    # When this flag is false, an id in nested attributes is only resolved
+    # within the association itself, and anything else raises an error.
+    #
+    # The default is `false`. Note that allowing reparenting via nested attributes
+    # is a potential security risk, since it could allow a malicious user to move
+    # records that they do not own to a parent record that they do own.
+    #
+    # This option will be removed in Mongoid 10, and the only behavior will be
+    # as if this option were set to false.
+    option :allow_reparenting_via_nested_attributes, default: false
+
+    # When this flag is true, any documents in associations with `autosave: true`
+    # will be saved even if they have not been changed. When this flag is false,
+    # only autosaved documents that have been changed will be saved. The default
+    # is `true`.
+    #
+    # This option will default to `false` in Mongoid 9.1, and will be removed
+    # in Mongoid 10, with the only behavior at that point being as if this
+    # option were set to `false`.
+    option :autosave_saves_unchanged_documents, default: true
+
     # When this flag is false, a document will become read-only only once the
     # #readonly! method is called, and an error will be raised on attempting
     # to save or update such documents, instead of just on delete. When this
@@ -180,6 +207,51 @@ module Mongoid
     # See https://jira.mongodb.org/browse/MONGOID-5785 for more details.
     option :allow_scopes_to_unset_default_scope, default: false
 
+    # The maximum number of seconds that evaluating a single query in memory
+    # may spend executing regular expressions. Queries against an embedded
+    # association are evaluated in the calling thread, so a pattern built from
+    # user input runs locally and can otherwise consume unbounded CPU. The
+    # limit is cumulative over the whole query, since cost grows with the
+    # number of documents and conditions as well as with the pattern.
+    #
+    # Set to nil to remove the limit. On Ruby 3.2 and later the remaining
+    # budget is compiled into the pattern, so the limit counts only the time
+    # spent matching. Earlier Rubies have no per-Regexp timeout, so the query
+    # is bounded with Timeout instead and the limit is wall clock over the
+    # whole in-memory evaluation.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5981 for details.
+    option :in_memory_regexp_time_limit, default: 5.0
+
+    # When false (default), query operators are restricted when building a
+    # selector, so that user-supplied input reaching the query builder cannot
+    # make MongoDB execute arbitrary JavaScript. Two rules are enforced:
+    #
+    # - An operator at the top level of an expression must appear in
+    #   +Criteria::Queryable::Selectable::ALLOWED_QUERY_OPERATORS+.
+    # - +$where+, +$function+, and +$accumulator+ are rejected at any depth,
+    #   including inside +$expr+ and the logical operators.
+    #
+    # This applies to every query method that accepts an expression, including
+    # +where+, +find_by+, +and+, +or+, +nor+, +not+, +any_of+, and +none_of+.
+    # It also governs the string form of +where+, e.g.
+    # +where("this.name == 'admin'")+, which the server evaluates as +$where+.
+    # Applications relying on that form must set this option to true.
+    #
+    # The APIs that request JavaScript explicitly, +Criteria#for_js+ and
+    # +js_query+, are unaffected: there the developer has asked for it.
+    #
+    # Set to true to restore the unrestricted pass-through behavior.
+    #
+    # Note that this option is deliberately not tied to +load_defaults+: an
+    # application that has opted into older defaults still gets the guard, and
+    # must set this option explicitly to turn it off.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5939,
+    # https://jira.mongodb.org/browse/MONGOID-5993,
+    # https://jira.mongodb.org/browse/MONGOID-5994 for details.
+    option :allow_unsafe_query_operators, default: false
+
     # Returns the Config singleton, for use in the configure DSL.
     #
     # @return [ self ] The Config singleton.

data/lib/mongoid/contextual/aggregable/memory.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 # rubocop:todo all
 
+require 'mongoid/field_readable'
+
 module Mongoid
   module Contextual
     module Aggregable
       # Contains behavior for aggregating values in memory.
       module Memory
+        include FieldReadable
 
         # Get all the aggregate values for the provided field.
         # Provided for interface consistency with Aggregable::Mongo.
@@ -30,7 +33,7 @@ module Mongoid
         #
         # @return [ Numeric ] The average.
         def avg(field)
-          total = count { |doc| !doc.send(field).nil? }
+          total = count { |doc| !read_field_value(doc, field).nil? }
           return nil unless total > 0
 
           total = total.to_f if total.is_a?(Integer)
@@ -116,7 +119,7 @@ module Mongoid
         def aggregate_by(field, method)
           return nil unless any?
 
-          map { |doc| doc.public_send(field) }.compact.public_send(method)
+          map { |doc| read_field_value(doc, field) }.compact.public_send(method)
         end
       end
     end

data/lib/mongoid/contextual/memory.rb

@@ -3,6 +3,7 @@
 
 require "mongoid/contextual/aggregable/memory"
 require "mongoid/association/eager_loadable"
+require "mongoid/field_readable"
 
 module Mongoid
   module Contextual
@@ -17,6 +18,7 @@ module Mongoid
       include Association::EagerLoadable
       include Queryable
       include Positional
+      include FieldReadable
 
       # @attribute [r] root The root document.
       # @attribute [r] path The atomic path.
@@ -172,10 +174,20 @@ module Mongoid
       # @param [ Criteria ] criteria The criteria.
       def initialize(criteria)
         @criteria, @klass = criteria, criteria.klass
-        @documents = criteria.documents.select do |doc|
-          @root ||= doc._root
-          @collection ||= root.collection
-          doc._matches?(criteria.selector)
+
+        # Resolving the collection can build a Mongo::Client the first time it
+        # runs, so it happens before the budget opens. Where the budget is
+        # enforced with Timeout the exception is asynchronous, and landing in
+        # the middle of that would leave a half-built client behind.
+        if (first = criteria.documents.first)
+          @root = first._root
+          @collection = @root.collection
+        end
+
+        # One regexp budget covers the whole scan, so that the limit bounds the
+        # query rather than each document individually.
+        @documents = Matcher::RegexpBudget.open(criteria.selector) do
+          criteria.documents.select { |doc| doc._matches?(criteria.selector) }
         end
         apply_sorting
         apply_options
@@ -733,11 +745,10 @@ module Mongoid
             # _translations hash so that we can get the specified translation in
             # the remaining
             if field&.localized?
-              document.send("#{segment}_translations")
+              document.public_send("#{segment}_translations")
             end
           end
-          meth = klass.aliased_associations[segment] || segment
-          res.nil? ? document.try(meth) : res
+          res.nil? ? read_field_value(document, segment) : res
         elsif document.is_a?(Hash)
           # TODO: Remove the indifferent access when implementing MONGOID-5410.
           document.key?(segment.to_s) ?

data/lib/mongoid/criteria/queryable/mergeable.rb

@@ -326,6 +326,10 @@ module Mongoid
               end
             end
           end
+          # Every query method that takes a user-supplied expression normalizes
+          # it here, so this is where the operator guard is enforced. See
+          # Selectable#_mongoid_validate_operators! for what it does not cover.
+          _mongoid_validate_operators!(result)
           result
         end
 

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -823,6 +823,12 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
+              unless Mongoid.allow_unsafe_query_operators?
+                raise Errors::InvalidQuery,
+                      "String criteria are not allowed because they compile to the '$where' operator, " \
+                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
               js_query(criterion)
             else
               expr_query(criterion)
@@ -832,6 +838,19 @@ module Mongoid
 
         private
 
+        # Operators permitted at the top level of a query expression without
+        # opt-in. Excludes $where (JS execution) and other operators not needed
+        # for ordinary application queries.
+        ALLOWED_QUERY_OPERATORS = %w[
+          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
+        ].freeze
+
+        # Operators that execute server-side JavaScript. These are rejected at
+        # any depth, not just at the top level: the allowlist above permits
+        # $expr and the logical operators, and their values are arbitrary
+        # nested expressions that can carry $function or $where.
+        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -857,6 +876,8 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
+          # The operator guard is applied by _mongoid_expand_keys, which every
+          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
@@ -872,6 +893,94 @@ module Mongoid
           end
         end
 
+        # Enforces the operator rules governed by the
+        # +allow_unsafe_query_operators+ configuration option against a
+        # normalized query expression.
+        #
+        # Two rules apply, and both are skipped when the option is true:
+        #
+        # - An operator at the top level of the expression must appear in
+        #   ALLOWED_QUERY_OPERATORS.
+        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
+        #
+        # This is called from #_mongoid_expand_keys rather than from the
+        # individual query methods, because that is the one point every query
+        # method taking a user-supplied expression passes through on its way to
+        # the selector.
+        #
+        # It deliberately does not cover the APIs that ask for JavaScript
+        # outright, such as #js_query and Criteria#for_js: there the developer
+        # has chosen server-side JavaScript, so there is nothing to guard
+        # against. The same goes for the low-level Storable methods
+        # (#add_field_expression, #add_operator_expression), which write to the
+        # selector directly.
+        #
+        # @param [ Hash ] expr A normalized query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
+        #
+        # @api private
+        def _mongoid_validate_operators!(expr)
+          return if Mongoid.allow_unsafe_query_operators?
+
+          expr.each_key do |field|
+            field_s = field.to_s
+            next unless field_s.start_with?('$')
+            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
+
+            raise Errors::InvalidQuery,
+                  "Operator '#{field_s}' is not allowed in a query expression. " \
+                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
+          end
+
+          _mongoid_validate_no_javascript!(expr)
+        end
+
+        # Walks a query expression looking for operators that execute
+        # server-side JavaScript, descending through both hashes and arrays so
+        # that nested forms such as {'$expr' => {'$function' => ...}} and
+        # {'$or' => [ {'$where' => ...} ]} are caught.
+        #
+        # The walk does not distinguish operator position from value position,
+        # so it also rejects queries where a JavaScript operator name appears as
+        # data rather than as an operator. Server 5.0+ permits $-prefixed field
+        # names in stored documents, which makes this reachable:
+        #
+        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
+        #
+        # Here the $eq marks its argument as a literal value to compare, so the
+        # server never evaluates it, but the guard raises anyway. The only
+        # workaround today is the global allow_unsafe_query_operators flag.
+        #
+        # TODO: discuss whether to track operator position (skipping the subtree
+        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
+        # iteration. It removes the false positive but adds exactly the kind of
+        # state that a real bypass could hide in, so it was left out for now.
+        #
+        # @param [ Object ] object A fragment of a query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
+        #
+        # @api private
+        def _mongoid_validate_no_javascript!(object)
+          case object
+          when Hash
+            object.each do |key, value|
+              key_s = key.to_s
+              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
+                raise Errors::InvalidQuery,
+                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
+                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
+
+              _mongoid_validate_no_javascript!(value)
+            end
+          when Array
+            object.each { |value| _mongoid_validate_no_javascript!(value) }
+          end
+        end
+
         # Force the values of the criterion to be evolved.
         #
         # @api private

data/lib/mongoid/encryptable.rb

@@ -37,6 +37,52 @@ module Mongoid
         !encrypt_metadata.empty? || fields.any? { |_, field| field.is_a?(Mongoid::Fields::Encrypted) }
       end
 
+      # Whether an encryption schema has to be generated for this model.
+      #
+      # True when the model declares encryption itself, and also when any model
+      # reachable through its embeds_one relations does. A model in the second
+      # group has no encrypted field of its own, but its collection still needs
+      # a schema, otherwise the embedded fields are written in plaintext.
+      #
+      # The answer is memoized, since this runs on the persistence path.
+      # Declaring encryption on a model after it has already been persisted is
+      # not supported.
+      #
+      # @return [ true | false ] Whether the model needs an encryption schema.
+      #
+      # @api private
+      def requires_encryption_schema?
+        return @requires_encryption_schema if defined?(@requires_encryption_schema)
+
+        @requires_encryption_schema = encrypted? || embeds_encrypted?([ self ])
+      end
+
+      # Whether any model reachable through this model's embeds_one relations
+      # declares encryption.
+      #
+      # embeds_many is not considered: libmongocrypt cannot express per-field
+      # encryption under array items, so those fields are never mapped.
+      #
+      # @param [ Array<Class> ] path The models the walk is already inside of.
+      #   A model embedding itself terminates here.
+      #
+      # @return [ true | false ] Whether an embedded model is encrypted.
+      #
+      # @api private
+      def embeds_encrypted?(path)
+        relations.each_value.any? do |relation|
+          next false unless relation.is_a?(Association::Embedded::EmbedsOne)
+
+          klass = relation.try_relation_class
+          # An association target does not have to be a Mongoid document, and
+          # the class it names does not have to exist.
+          next false unless klass.respond_to?(:encrypted?)
+          next false if path.include?(klass)
+
+          klass.encrypted? || klass.embeds_encrypted?(path + [ klass ])
+        end
+      end
+
       # Override the key_id for the model.
       #
       # This method is solely for testing purposes and should not be used in

data/lib/mongoid/errors/in_memory_regexp_timeout.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when evaluating a query in memory exceeds
+    # Mongoid::Config.in_memory_regexp_time_limit.
+    #
+    # What the limit bounds depends on the Ruby in use. Where per-Regexp
+    # timeouts are available it is the time spent executing regular
+    # expressions; elsewhere it is the elapsed time of the whole in-memory
+    # evaluation. The message is worded to hold either way.
+    class InMemoryRegexpTimeout < MongoidError
+      # Create the new error.
+      #
+      # @example Create the new in-memory regexp timeout error.
+      #   InMemoryRegexpTimeout.new(5.0)
+      #
+      # @param [ Float ] limit The limit that was exceeded, in seconds. Not
+      #   always the configured one: a global Regexp.timeout stricter than the
+      #   configuration takes its place.
+      def initialize(limit)
+        super(compose_message('in_memory_regexp_timeout', limit: limit))
+      end
+    end
+  end
+end

data/lib/mongoid/errors/no_encryption_schema.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when a model declares encrypted fields, but the
+    # namespace it is about to be persisted to is not covered by the automatic
+    # encryption schema of the client in use. Without a schema the driver has
+    # nothing to encrypt with, and the fields would be stored in plaintext.
+    class NoEncryptionSchema < MongoidError
+      # Create the new error.
+      #
+      # @example Create the error.
+      #   NoEncryptionSchema.new(Band, 'music.bands', :default)
+      #
+      # @param [ Class ] klass The model class.
+      # @param [ String ] namespace The namespace the model resolved to.
+      # @param [ String | Symbol ] client The name of the client in use.
+      def initialize(klass, namespace, client)
+        super(
+          compose_message(
+            'no_encryption_schema',
+            { klass: klass, namespace: namespace, client: client }
+          )
+        )
+      end
+    end
+  end
+end

data/lib/mongoid/errors.rb

@@ -12,6 +12,7 @@ require "mongoid/errors/document_not_found"
 require "mongoid/errors/empty_config_file"
 require "mongoid/errors/immutable_attribute"
 require "mongoid/errors/in_memory_collation_not_supported"
+require "mongoid/errors/in_memory_regexp_timeout"
 require "mongoid/errors/invalid_auto_encryption_configuration"
 require "mongoid/errors/invalid_around_callback"
 require "mongoid/errors/invalid_async_query_executor"
@@ -52,6 +53,7 @@ require "mongoid/errors/mixed_client_configuration"
 require "mongoid/errors/nested_attributes_metadata_not_found"
 require "mongoid/errors/no_default_client"
 require "mongoid/errors/no_environment"
+require "mongoid/errors/no_encryption_schema"
 require "mongoid/errors/no_map_reduce_output"
 require "mongoid/errors/no_metadata"
 require "mongoid/errors/no_parent"

data/lib/mongoid/field_readable.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+module Mongoid
+  # Reads the value of a field name from a document without dispatching the
+  # name as an arbitrary method.
+  #
+  # Field names may come from application input, where a name like +destroy+
+  # or +attributes+ would delete the document or disclose its contents.
+  # Declared field and association names are validated when they are declared
+  # (see Mongoid.destructive_fields), so a name that resolves to one of them
+  # is safe to send to a document. Any other name is read from the attributes
+  # hash, which is what the database-backed query contexts do.
+  #
+  # @api private
+  module FieldReadable
+    private
+
+    # Read the value of the given field name from the given document.
+    #
+    # @param [ Document ] document The document to read from.
+    # @param [ String | Symbol ] name The name of the field.
+    #
+    # @return [ Object | nil ] The value of the field, or nil when the name
+    #   is neither a declared field nor present in the attributes.
+    def read_field_value(document, name)
+      name = name.to_s
+      # A blank name cannot name a field. Return nil, which is what reading
+      # one has always done.
+      return nil if name.blank?
+
+      if (meth = readable_method_for(document.class, name))
+        document.public_send(meth)
+      else
+        document.attributes[document.class.database_field_name(name)]
+      end
+    end
+
+    # Resolve the given name to a method that is declared by the given class,
+    # and therefore safe to send to one of its instances.
+    #
+    # @param [ Class ] klass The document class.
+    # @param [ String ] name The name of the field.
+    #
+    # @return [ String | nil ] The method to send, or nil when the name is
+    #   not declared by the class.
+    def readable_method_for(klass, name)
+      # Fields, associations, and field aliases each define a reader of their
+      # own name. Note that associations must be resolved before aliases: a
+      # belongs_to aliases its own name to its foreign key, and reading
+      # `band` must give the document, not the id.
+      return name if klass.relations.key?(name) ||
+                     klass.fields.key?(name) ||
+                     klass.aliased_fields.key?(name)
+
+      # An association may also be named by its `store_as`, which has no
+      # reader of its own, or by its ids accessor, which does.
+      if (assoc = klass.relations[klass.aliased_associations[name]])
+        return (assoc.store_as == name) ? assoc.name.to_s : name
+      end
+
+      # Localized fields also get a _translations reader, which does not
+      # appear in the fields hash.
+      base = name.delete_suffix(Fields::TRANSLATIONS_SFX)
+      return nil if base == name
+
+      name if klass.fields[klass.database_field_name(base)]&.localized?
+    end
+  end
+end

data/lib/mongoid/indexable.rb

@@ -27,18 +27,9 @@ module Mongoid
       def create_indexes
         return unless index_specifications
 
-        default_options = {background: Config.background_indexing}
-
-        index_specifications.each do |spec|
-          key, options = spec.key, default_options.merge(spec.options)
-          if database = options[:database]
-            with(database: database) do |klass|
-              klass.collection.indexes(session: _session).create_one(key, options.except(:database))
-            end
-          else
-            collection.indexes(session: _session).create_one(key, options)
-          end
-        end and true
+        Threaded.with_collection_management do
+          perform_create_indexes
+        end
       end
 
       # Send the actual index removal comments to the MongoDB driver,
@@ -49,21 +40,9 @@ module Mongoid
       #
       # @return [ true ] If the operation succeeded.
       def remove_indexes
-        indexed_database_names.each do |database|
-          with(database: database) do |klass|
-            begin
-              klass.collection.indexes(session: _session).each do |spec|
-                unless spec["name"] == "_id_"
-                  klass.collection.indexes(session: _session).drop_one(spec["key"])
-                  logger.info(
-                    "MONGOID: Removed index '#{spec["name"]}' on collection " +
-                    "'#{klass.collection.name}' in database '#{database}'."
-                  )
-                end
-              end
-            rescue Mongo::Error::OperationFailure; end
-          end
-        end and true
+        Threaded.with_collection_management do
+          perform_remove_indexes
+        end
       end
 
       # Add the default indexes to the root document if they do not already
@@ -118,6 +97,39 @@ module Mongoid
 
       private
 
+      def perform_create_indexes
+        default_options = {background: Config.background_indexing}
+
+        index_specifications.each do |spec|
+          key, options = spec.key, default_options.merge(spec.options)
+          if database = options[:database]
+            with(database: database) do |klass|
+              klass.collection.indexes(session: _session).create_one(key, options.except(:database))
+            end
+          else
+            collection.indexes(session: _session).create_one(key, options)
+          end
+        end and true
+      end
+
+      def perform_remove_indexes
+        indexed_database_names.each do |database|
+          with(database: database) do |klass|
+            begin
+              klass.collection.indexes(session: _session).each do |spec|
+                unless spec["name"] == "_id_"
+                  klass.collection.indexes(session: _session).drop_one(spec["key"])
+                  logger.info(
+                    "MONGOID: Removed index '#{spec["name"]}' on collection " +
+                    "'#{klass.collection.name}' in database '#{database}'."
+                  )
+                end
+              end
+            rescue Mongo::Error::OperationFailure; end
+          end
+        end and true
+      end
+
       # Get the names of all databases for this model that have index
       # definitions.
       #

data/lib/mongoid/matchable.rb

@@ -18,7 +18,12 @@ module Mongoid
     #
     # @return [ true | false ] True if matches, false if not.
     def _matches?(selector)
-      Matcher::Expression.matches?(self, selector)
+      # Opens a regexp budget for this document only. Callers that match many
+      # documents against one selector open a budget of their own first, and
+      # this one joins it rather than giving every document a fresh limit.
+      Matcher::RegexpBudget.open(selector) do
+        Matcher::Expression.matches?(self, selector)
+      end
     end
   end
 end

data/lib/mongoid/matcher/eq_impl_with_regexp.rb

@@ -1,13 +1,10 @@
-# rubocop:todo all
 module Mongoid
   module Matcher
-
     # This is an internal equality implementation that performs exact
     # comparisons and regular expression matches.
     #
     # @api private
     module EqImplWithRegexp
-
       # Returns whether a value satisfies an $eq (or similar) expression,
       # performing a regular expression match if the condition is a regular
       # expression.
@@ -19,14 +16,12 @@ module Mongoid
       # @return [ true | false ] Whether the value matches.
       #
       # @api private
-      module_function def matches?(original_operator, value, condition)
+      module_function def matches?(_original_operator, value, condition)
         case condition
-        when Regexp
-          value =~ condition
-        when ::BSON::Regexp::Raw
-          value =~ condition.compile
+        when Regexp, ::BSON::Regexp::Raw
+          value.respond_to?(:=~) && RegexpBudget.match?(value, condition)
         else
-          if value.kind_of?(Time) && condition.kind_of?(Time)
+          if value.is_a?(Time) && condition.is_a?(Time)
             EqImpl.time_eq?(value, condition)
           else
             value == condition