mongoid 9.0.10 → 9.0.12

data/spec/mongoid/contextual/aggregable/memory_spec.rb

@@ -582,4 +582,95 @@ describe Mongoid::Contextual::Aggregable::Memory do
       end
     end
   end
+
+  context 'when the field name is a method name' do
+    let!(:depeche) do
+      Band.create!(name: 'Depeche Mode', likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it 'does not call the method for sum' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.sum(:delete)).to eq(0)
+    end
+
+    it 'does not call the method for min' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.min(:delete)).to be_nil
+    end
+
+    it 'does not call the method for max' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.max(:delete)).to be_nil
+    end
+
+    it 'does not call the method for avg' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.avg(:delete)).to be_nil
+    end
+
+    it 'does not call the method for aggregates' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.aggregates(:delete))
+        .to eq('count' => 0, 'avg' => nil, 'max' => nil, 'min' => nil, 'sum' => 0)
+    end
+
+    it 'does not call a private method for avg' do
+      expect(depeche).not_to receive(:exit)
+      expect(context.avg(:exit)).to be_nil
+    end
+  end
+
+  context 'when the field is not defined' do
+    let!(:depeche) do
+      Band.create!(name: 'Depeche Mode', likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it 'returns zero for sum' do
+      expect(context.sum(:not_a_field)).to eq(0)
+    end
+
+    it 'returns nil for min' do
+      expect(context.min(:not_a_field)).to be_nil
+    end
+
+    it 'returns nil for max' do
+      expect(context.max(:not_a_field)).to be_nil
+    end
+
+    it 'returns nil for avg' do
+      expect(context.avg(:not_a_field)).to be_nil
+    end
+  end
+
+  context 'when the field is the foreign key of a many to many association' do
+    let!(:preference) do
+      Preference.create!(name: 'nature')
+    end
+
+    let!(:person) do
+      Person.new(preferences: [ preference ])
+    end
+
+    let(:criteria) do
+      Person.all.tap do |crit|
+        crit.documents = [ person ]
+      end
+    end
+
+    it 'aggregates the stored ids' do
+      expect(context.max(:preference_ids)).to eq([ preference.id ])
+    end
+  end
 end

data/spec/mongoid/contextual/memory_spec.rb

@@ -588,6 +588,27 @@ describe Mongoid::Contextual::Memory do
         expect(context.distinct("label.sales")).to eq([ BigDecimal("1E2") ])
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.distinct(:destroy)).to eq([ nil ])
+      end
+    end
   end
 
   describe "#each" do
@@ -1826,6 +1847,116 @@ describe Mongoid::Contextual::Memory do
         ])
       end
     end
+
+    context 'when plucking a dynamic attribute' do
+      let(:criteria) do
+        Band.all.tap do |crit|
+          crit.documents = [ Band.create!(name: 'Depeche Mode', mood: 'dark') ]
+        end
+      end
+
+      it 'returns the value from the attributes' do
+        expect(context.pluck(:mood)).to eq([ 'dark' ])
+      end
+    end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.pluck(:destroy)).to eq([ nil ])
+      end
+
+      it 'does not return the attributes hash' do
+        expect(context.pluck(:attributes)).to eq([ nil ])
+      end
+
+      it 'does not traverse to the parent document' do
+        expect(context.pluck('_root.ssn')).to eq([ nil ])
+      end
+
+      it 'does not destroy the parent document' do
+        expect(context.pluck('_root.destroy')).to eq([ nil ])
+        expect(Person.where(_id: person.id).count).to eq(1)
+      end
+    end
+
+    context 'when plucking a belongs_to association' do
+      let!(:band) do
+        Band.create!(name: 'Depeche Mode')
+      end
+
+      let!(:artist) do
+        Artist.create!(band: band)
+      end
+
+      let(:criteria) do
+        Artist.all.tap do |crit|
+          crit.documents = [ artist ]
+        end
+      end
+
+      it 'traverses to the associated document' do
+        expect(context.pluck('band.name')).to eq([ 'Depeche Mode' ])
+      end
+
+      it 'returns the document for the association name' do
+        expect(context.pluck(:band)).to eq([ band ])
+      end
+
+      it 'returns the id for the foreign key' do
+        expect(context.pluck(:band_id)).to eq([ band.id ])
+      end
+    end
+
+    context 'when plucking the foreign key of a many to many association' do
+      let!(:preference) do
+        Preference.create!(name: 'nature')
+      end
+
+      let!(:person) do
+        Person.create!(preferences: [ preference ])
+      end
+
+      let(:criteria) do
+        Person.all.tap do |crit|
+          crit.documents = [ person ]
+        end
+      end
+
+      it 'returns the stored ids' do
+        expect(context.pluck(:preference_ids)).to eq([ [ preference.id ] ])
+      end
+    end
+
+    context 'when the field path has an empty segment' do
+      let!(:band) do
+        Band.create!(name: 'Depeche Mode', label: Label.new(name: 'Mute'))
+      end
+
+      let(:criteria) do
+        Band.all.tap do |crit|
+          crit.documents = [ band ]
+        end
+      end
+
+      it 'returns nil' do
+        expect(context.pluck('label..name')).to eq([ nil ])
+      end
+    end
   end
 
   describe "#pick" do
@@ -1886,6 +2017,27 @@ describe Mongoid::Contextual::Memory do
         expect(picked).to be_nil
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.pick(:destroy)).to be_nil
+      end
+    end
   end
 
   describe "#tally" do
@@ -2340,6 +2492,31 @@ describe Mongoid::Contextual::Memory do
         )
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.tally(:destroy)).to eq(nil => 1)
+      end
+
+      it 'does not disclose the parent document fields' do
+        expect(context.tally('_root.ssn')).to eq(nil => 1)
+      end
+    end
   end
 
   describe '#inc' do

data/spec/mongoid/criteria/queryable/selectable_logical_spec.rb

@@ -1830,6 +1830,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
 
       context 'when the following criteria uses string were form' do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:selection) do
           query.not.where('hello world')

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -36,6 +36,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
     it_behaves_like 'requires a non-nil argument'
 
     context "when provided a string" do
+      # String criteria compile to $where, which requires the opt-in.
+      config_override :allow_unsafe_query_operators, true
 
       let(:selection) do
         query.where("this.value = 10")
@@ -587,4 +589,202 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
+
+  describe 'top-level operator injection guard' do
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      context 'when passing $where' do
+        it 'does not raise' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'does not raise' do
+          expect do
+            query.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'does not raise' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing $function' do
+        it 'does not raise' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      context 'when passing $where' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      context 'when passing $function' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
+        end
+      end
+
+      context 'when the error mentions allow_unsafe_query_operators' do
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('$where' => 'true')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
+        context "when passing #{op} (allowlisted)" do
+          it 'does not raise' do
+            value = case op
+                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
+                    when '$text' then { '$search' => 'hi' }
+                    when '$expr' then { '$gt' => [ '$a', 1 ] }
+                    when '$jsonSchema' then { 'required' => [ 'x' ] }
+                    else true
+                    end
+            expect { query.where(op => value) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
+  describe 'nested operator injection guard' do
+    js = 'this.name == "admin"'
+
+    function_expr = {
+      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
+    }.freeze
+
+    accumulator_expr = {
+      '$accumulator' => {
+        'init' => 'function() { return 0; }',
+        'accumulate' => 'function() { return 0; }',
+        'accumulateArgs' => [],
+        'merge' => 'function() { return 0; }',
+        'lang' => 'js'
+      }
+    }.freeze
+
+    # Every path into the selector that does not route through #expr_query,
+    # plus the nested forms that a top-level key check cannot see.
+    unsafe_queries = {
+      'and with a $where key' => ->(query) { query.and('$where' => js) },
+      'or with a $where key' => ->(query) { query.or('$where' => js) },
+      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
+      'not with a $where key' => ->(query) { query.not('$where' => js) },
+      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
+      'none_of with a $where key' => ->(query) { query.none_of('$where' => js) },
+      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
+      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
+      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
+      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
+      'where with $where three levels deep' => lambda { |query|
+        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
+      },
+      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
+    }.freeze
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'raises InvalidQuery' do
+            expect do
+              builder.call(query)
+            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
+          end
+        end
+      end
+
+      it 'includes the config opt-in in the message' do
+        expect do
+          query.or('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+      end
+
+      context 'when the nested expression is safe' do
+        it 'permits $or with field expressions' do
+          expect do
+            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
+          end.not_to raise_error
+        end
+
+        it 'permits $expr with aggregation operators' do
+          expect do
+            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
+          end.not_to raise_error
+        end
+
+        it 'permits a field whose name resembles a javascript operator' do
+          expect do
+            query.where('where' => js)
+          end.not_to raise_error
+        end
+
+        it 'permits a value that resembles a javascript operator' do
+          expect do
+            query.where('name' => '$where')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'does not raise' do
+            expect { builder.call(query) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
 end

data/spec/mongoid/criteria_spec.rb

@@ -2432,6 +2432,8 @@ describe Mongoid::Criteria do
       end
 
       context "when the criteria is not embedded" do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:criteria) do
           Band.where("this.name == 'Depeche Mode'")

data/spec/mongoid/encryptable_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'support/crypt/models'
+
+describe Mongoid::Encryptable do
+  describe '.requires_encryption_schema?' do
+    context 'when the model declares encrypt_with' do
+      it 'returns true' do
+        expect(Crypt::Vault.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model has an encrypted field' do
+      it 'returns true' do
+        expect(Crypt::User.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model embeds an encrypted model' do
+      it 'returns true' do
+        expect(Crypt::Wallet.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the encrypted model is nested three levels deep' do
+      it 'returns true' do
+        expect(Crypt::Owner.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model declares no encryption anywhere' do
+      it 'returns false' do
+        expect(Person.requires_encryption_schema?).to be false
+      end
+    end
+
+    # An association target does not have to be a Mongoid document. Truck
+    # embeds a plain Ruby class.
+    context 'when an embedded association target is not a document' do
+      it 'returns false' do
+        expect(Truck.requires_encryption_schema?).to be false
+      end
+    end
+
+    context 'when the model embeds itself' do
+      it 'terminates' do
+        expect(Crypt::Comment.requires_encryption_schema?).to be true
+      end
+    end
+
+    # Every model is asked this question, including ones naming an embedded
+    # class that is never defined. Such an association cannot be used, so
+    # nothing is embedded through it and nothing needs encrypting.
+    context 'when an embedded association names a class that is not defined' do
+      it 'returns false' do
+        expect(Crypt::Drawer.requires_encryption_schema?).to be false
+      end
+    end
+  end
+end

data/spec/mongoid/errors/document_not_found_spec.rb

@@ -64,9 +64,16 @@ describe Mongoid::Errors::DocumentNotFound do
       end
 
       it "contains the problem in the message" do
-        expect(error.message).to include(
-          "Document not found for class Person with attributes {:name=>\"syd\"}."
-        )
+        # Ruby 3.4+ changed Hash#inspect format from {:name=>"syd"} to {name: "syd"}
+        if RUBY_VERSION >= '3.4'
+          expect(error.message).to include(
+            "Document not found for class Person with attributes {name: \"syd\"}."
+          )
+        else
+          expect(error.message).to include(
+            "Document not found for class Person with attributes {:name=>\"syd\"}."
+          )
+        end
       end
 
       it "contains the summary in the message" do