mongoid 9.0.11 → 9.0.12

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -823,6 +823,12 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
+              unless Mongoid.allow_unsafe_query_operators?
+                raise Errors::InvalidQuery,
+                      "String criteria are not allowed because they compile to the '$where' operator, " \
+                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
               js_query(criterion)
             else
               expr_query(criterion)
@@ -832,6 +838,19 @@ module Mongoid
 
         private
 
+        # Operators permitted at the top level of a query expression without
+        # opt-in. Excludes $where (JS execution) and other operators not needed
+        # for ordinary application queries.
+        ALLOWED_QUERY_OPERATORS = %w[
+          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
+        ].freeze
+
+        # Operators that execute server-side JavaScript. These are rejected at
+        # any depth, not just at the top level: the allowlist above permits
+        # $expr and the logical operators, and their values are arbitrary
+        # nested expressions that can carry $function or $where.
+        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -857,6 +876,8 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
+          # The operator guard is applied by _mongoid_expand_keys, which every
+          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
@@ -872,6 +893,94 @@ module Mongoid
           end
         end
 
+        # Enforces the operator rules governed by the
+        # +allow_unsafe_query_operators+ configuration option against a
+        # normalized query expression.
+        #
+        # Two rules apply, and both are skipped when the option is true:
+        #
+        # - An operator at the top level of the expression must appear in
+        #   ALLOWED_QUERY_OPERATORS.
+        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
+        #
+        # This is called from #_mongoid_expand_keys rather than from the
+        # individual query methods, because that is the one point every query
+        # method taking a user-supplied expression passes through on its way to
+        # the selector.
+        #
+        # It deliberately does not cover the APIs that ask for JavaScript
+        # outright, such as #js_query and Criteria#for_js: there the developer
+        # has chosen server-side JavaScript, so there is nothing to guard
+        # against. The same goes for the low-level Storable methods
+        # (#add_field_expression, #add_operator_expression), which write to the
+        # selector directly.
+        #
+        # @param [ Hash ] expr A normalized query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
+        #
+        # @api private
+        def _mongoid_validate_operators!(expr)
+          return if Mongoid.allow_unsafe_query_operators?
+
+          expr.each_key do |field|
+            field_s = field.to_s
+            next unless field_s.start_with?('$')
+            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
+
+            raise Errors::InvalidQuery,
+                  "Operator '#{field_s}' is not allowed in a query expression. " \
+                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
+          end
+
+          _mongoid_validate_no_javascript!(expr)
+        end
+
+        # Walks a query expression looking for operators that execute
+        # server-side JavaScript, descending through both hashes and arrays so
+        # that nested forms such as {'$expr' => {'$function' => ...}} and
+        # {'$or' => [ {'$where' => ...} ]} are caught.
+        #
+        # The walk does not distinguish operator position from value position,
+        # so it also rejects queries where a JavaScript operator name appears as
+        # data rather than as an operator. Server 5.0+ permits $-prefixed field
+        # names in stored documents, which makes this reachable:
+        #
+        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
+        #
+        # Here the $eq marks its argument as a literal value to compare, so the
+        # server never evaluates it, but the guard raises anyway. The only
+        # workaround today is the global allow_unsafe_query_operators flag.
+        #
+        # TODO: discuss whether to track operator position (skipping the subtree
+        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
+        # iteration. It removes the false positive but adds exactly the kind of
+        # state that a real bypass could hide in, so it was left out for now.
+        #
+        # @param [ Object ] object A fragment of a query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
+        #
+        # @api private
+        def _mongoid_validate_no_javascript!(object)
+          case object
+          when Hash
+            object.each do |key, value|
+              key_s = key.to_s
+              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
+                raise Errors::InvalidQuery,
+                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
+                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
+
+              _mongoid_validate_no_javascript!(value)
+            end
+          when Array
+            object.each { |value| _mongoid_validate_no_javascript!(value) }
+          end
+        end
+
         # Force the values of the criterion to be evolved.
         #
         # @api private

data/lib/mongoid/encryptable.rb

@@ -37,6 +37,52 @@ module Mongoid
         !encrypt_metadata.empty? || fields.any? { |_, field| field.is_a?(Mongoid::Fields::Encrypted) }
       end
 
+      # Whether an encryption schema has to be generated for this model.
+      #
+      # True when the model declares encryption itself, and also when any model
+      # reachable through its embeds_one relations does. A model in the second
+      # group has no encrypted field of its own, but its collection still needs
+      # a schema, otherwise the embedded fields are written in plaintext.
+      #
+      # The answer is memoized, since this runs on the persistence path.
+      # Declaring encryption on a model after it has already been persisted is
+      # not supported.
+      #
+      # @return [ true | false ] Whether the model needs an encryption schema.
+      #
+      # @api private
+      def requires_encryption_schema?
+        return @requires_encryption_schema if defined?(@requires_encryption_schema)
+
+        @requires_encryption_schema = encrypted? || embeds_encrypted?([ self ])
+      end
+
+      # Whether any model reachable through this model's embeds_one relations
+      # declares encryption.
+      #
+      # embeds_many is not considered: libmongocrypt cannot express per-field
+      # encryption under array items, so those fields are never mapped.
+      #
+      # @param [ Array<Class> ] path The models the walk is already inside of.
+      #   A model embedding itself terminates here.
+      #
+      # @return [ true | false ] Whether an embedded model is encrypted.
+      #
+      # @api private
+      def embeds_encrypted?(path)
+        relations.each_value.any? do |relation|
+          next false unless relation.is_a?(Association::Embedded::EmbedsOne)
+
+          klass = relation.try_relation_class
+          # An association target does not have to be a Mongoid document, and
+          # the class it names does not have to exist.
+          next false unless klass.respond_to?(:encrypted?)
+          next false if path.include?(klass)
+
+          klass.encrypted? || klass.embeds_encrypted?(path + [ klass ])
+        end
+      end
+
       # Override the key_id for the model.
       #
       # This method is solely for testing purposes and should not be used in

data/lib/mongoid/errors/in_memory_regexp_timeout.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when evaluating a query in memory exceeds
+    # Mongoid::Config.in_memory_regexp_time_limit.
+    #
+    # What the limit bounds depends on the Ruby in use. Where per-Regexp
+    # timeouts are available it is the time spent executing regular
+    # expressions; elsewhere it is the elapsed time of the whole in-memory
+    # evaluation. The message is worded to hold either way.
+    class InMemoryRegexpTimeout < MongoidError
+      # Create the new error.
+      #
+      # @example Create the new in-memory regexp timeout error.
+      #   InMemoryRegexpTimeout.new(5.0)
+      #
+      # @param [ Float ] limit The limit that was exceeded, in seconds. Not
+      #   always the configured one: a global Regexp.timeout stricter than the
+      #   configuration takes its place.
+      def initialize(limit)
+        super(compose_message('in_memory_regexp_timeout', limit: limit))
+      end
+    end
+  end
+end

data/lib/mongoid/errors/no_encryption_schema.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when a model declares encrypted fields, but the
+    # namespace it is about to be persisted to is not covered by the automatic
+    # encryption schema of the client in use. Without a schema the driver has
+    # nothing to encrypt with, and the fields would be stored in plaintext.
+    class NoEncryptionSchema < MongoidError
+      # Create the new error.
+      #
+      # @example Create the error.
+      #   NoEncryptionSchema.new(Band, 'music.bands', :default)
+      #
+      # @param [ Class ] klass The model class.
+      # @param [ String ] namespace The namespace the model resolved to.
+      # @param [ String | Symbol ] client The name of the client in use.
+      def initialize(klass, namespace, client)
+        super(
+          compose_message(
+            'no_encryption_schema',
+            { klass: klass, namespace: namespace, client: client }
+          )
+        )
+      end
+    end
+  end
+end

data/lib/mongoid/errors.rb

@@ -12,6 +12,7 @@ require "mongoid/errors/document_not_found"
 require "mongoid/errors/empty_config_file"
 require "mongoid/errors/immutable_attribute"
 require "mongoid/errors/in_memory_collation_not_supported"
+require "mongoid/errors/in_memory_regexp_timeout"
 require "mongoid/errors/invalid_auto_encryption_configuration"
 require "mongoid/errors/invalid_around_callback"
 require "mongoid/errors/invalid_async_query_executor"
@@ -52,6 +53,7 @@ require "mongoid/errors/mixed_client_configuration"
 require "mongoid/errors/nested_attributes_metadata_not_found"
 require "mongoid/errors/no_default_client"
 require "mongoid/errors/no_environment"
+require "mongoid/errors/no_encryption_schema"
 require "mongoid/errors/no_map_reduce_output"
 require "mongoid/errors/no_metadata"
 require "mongoid/errors/no_parent"

data/lib/mongoid/field_readable.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+module Mongoid
+  # Reads the value of a field name from a document without dispatching the
+  # name as an arbitrary method.
+  #
+  # Field names may come from application input, where a name like +destroy+
+  # or +attributes+ would delete the document or disclose its contents.
+  # Declared field and association names are validated when they are declared
+  # (see Mongoid.destructive_fields), so a name that resolves to one of them
+  # is safe to send to a document. Any other name is read from the attributes
+  # hash, which is what the database-backed query contexts do.
+  #
+  # @api private
+  module FieldReadable
+    private
+
+    # Read the value of the given field name from the given document.
+    #
+    # @param [ Document ] document The document to read from.
+    # @param [ String | Symbol ] name The name of the field.
+    #
+    # @return [ Object | nil ] The value of the field, or nil when the name
+    #   is neither a declared field nor present in the attributes.
+    def read_field_value(document, name)
+      name = name.to_s
+      # A blank name cannot name a field. Return nil, which is what reading
+      # one has always done.
+      return nil if name.blank?
+
+      if (meth = readable_method_for(document.class, name))
+        document.public_send(meth)
+      else
+        document.attributes[document.class.database_field_name(name)]
+      end
+    end
+
+    # Resolve the given name to a method that is declared by the given class,
+    # and therefore safe to send to one of its instances.
+    #
+    # @param [ Class ] klass The document class.
+    # @param [ String ] name The name of the field.
+    #
+    # @return [ String | nil ] The method to send, or nil when the name is
+    #   not declared by the class.
+    def readable_method_for(klass, name)
+      # Fields, associations, and field aliases each define a reader of their
+      # own name. Note that associations must be resolved before aliases: a
+      # belongs_to aliases its own name to its foreign key, and reading
+      # `band` must give the document, not the id.
+      return name if klass.relations.key?(name) ||
+                     klass.fields.key?(name) ||
+                     klass.aliased_fields.key?(name)
+
+      # An association may also be named by its `store_as`, which has no
+      # reader of its own, or by its ids accessor, which does.
+      if (assoc = klass.relations[klass.aliased_associations[name]])
+        return (assoc.store_as == name) ? assoc.name.to_s : name
+      end
+
+      # Localized fields also get a _translations reader, which does not
+      # appear in the fields hash.
+      base = name.delete_suffix(Fields::TRANSLATIONS_SFX)
+      return nil if base == name
+
+      name if klass.fields[klass.database_field_name(base)]&.localized?
+    end
+  end
+end

data/lib/mongoid/indexable.rb

@@ -27,18 +27,9 @@ module Mongoid
       def create_indexes
         return unless index_specifications
 
-        default_options = {background: Config.background_indexing}
-
-        index_specifications.each do |spec|
-          key, options = spec.key, default_options.merge(spec.options)
-          if database = options[:database]
-            with(database: database) do |klass|
-              klass.collection.indexes(session: _session).create_one(key, options.except(:database))
-            end
-          else
-            collection.indexes(session: _session).create_one(key, options)
-          end
-        end and true
+        Threaded.with_collection_management do
+          perform_create_indexes
+        end
       end
 
       # Send the actual index removal comments to the MongoDB driver,
@@ -49,21 +40,9 @@ module Mongoid
       #
       # @return [ true ] If the operation succeeded.
       def remove_indexes
-        indexed_database_names.each do |database|
-          with(database: database) do |klass|
-            begin
-              klass.collection.indexes(session: _session).each do |spec|
-                unless spec["name"] == "_id_"
-                  klass.collection.indexes(session: _session).drop_one(spec["key"])
-                  logger.info(
-                    "MONGOID: Removed index '#{spec["name"]}' on collection " +
-                    "'#{klass.collection.name}' in database '#{database}'."
-                  )
-                end
-              end
-            rescue Mongo::Error::OperationFailure; end
-          end
-        end and true
+        Threaded.with_collection_management do
+          perform_remove_indexes
+        end
       end
 
       # Add the default indexes to the root document if they do not already
@@ -118,6 +97,39 @@ module Mongoid
 
       private
 
+      def perform_create_indexes
+        default_options = {background: Config.background_indexing}
+
+        index_specifications.each do |spec|
+          key, options = spec.key, default_options.merge(spec.options)
+          if database = options[:database]
+            with(database: database) do |klass|
+              klass.collection.indexes(session: _session).create_one(key, options.except(:database))
+            end
+          else
+            collection.indexes(session: _session).create_one(key, options)
+          end
+        end and true
+      end
+
+      def perform_remove_indexes
+        indexed_database_names.each do |database|
+          with(database: database) do |klass|
+            begin
+              klass.collection.indexes(session: _session).each do |spec|
+                unless spec["name"] == "_id_"
+                  klass.collection.indexes(session: _session).drop_one(spec["key"])
+                  logger.info(
+                    "MONGOID: Removed index '#{spec["name"]}' on collection " +
+                    "'#{klass.collection.name}' in database '#{database}'."
+                  )
+                end
+              end
+            rescue Mongo::Error::OperationFailure; end
+          end
+        end and true
+      end
+
       # Get the names of all databases for this model that have index
       # definitions.
       #

data/lib/mongoid/matchable.rb

@@ -18,7 +18,12 @@ module Mongoid
     #
     # @return [ true | false ] True if matches, false if not.
     def _matches?(selector)
-      Matcher::Expression.matches?(self, selector)
+      # Opens a regexp budget for this document only. Callers that match many
+      # documents against one selector open a budget of their own first, and
+      # this one joins it rather than giving every document a fresh limit.
+      Matcher::RegexpBudget.open(selector) do
+        Matcher::Expression.matches?(self, selector)
+      end
     end
   end
 end

data/lib/mongoid/matcher/eq_impl_with_regexp.rb

@@ -1,13 +1,10 @@
-# rubocop:todo all
 module Mongoid
   module Matcher
-
     # This is an internal equality implementation that performs exact
     # comparisons and regular expression matches.
     #
     # @api private
     module EqImplWithRegexp
-
       # Returns whether a value satisfies an $eq (or similar) expression,
       # performing a regular expression match if the condition is a regular
       # expression.
@@ -19,14 +16,12 @@ module Mongoid
       # @return [ true | false ] Whether the value matches.
       #
       # @api private
-      module_function def matches?(original_operator, value, condition)
+      module_function def matches?(_original_operator, value, condition)
         case condition
-        when Regexp
-          value =~ condition
-        when ::BSON::Regexp::Raw
-          value =~ condition.compile
+        when Regexp, ::BSON::Regexp::Raw
+          value.respond_to?(:=~) && RegexpBudget.match?(value, condition)
         else
-          if value.kind_of?(Time) && condition.kind_of?(Time)
+          if value.is_a?(Time) && condition.is_a?(Time)
             EqImpl.time_eq?(value, condition)
           else
             value == condition

data/lib/mongoid/matcher/regex.rb

@@ -1,14 +1,11 @@
-# rubocop:todo all
 module Mongoid
   module Matcher
-
     # In-memory matcher for $regex expression.
     #
     # @see https://www.mongodb.com/docs/manual/reference/operator/query/regex/
     #
     # @api private
     module Regex
-
       # Returns whether a value satisfies a $regex expression.
       #
       # @param [ true | false ] exists Not used.
@@ -18,25 +15,24 @@ module Mongoid
       # @return [ true | false ] Whether the value matches.
       #
       # @api private
-      module_function def matches?(exists, value, condition)
-        condition = case condition
-        when Regexp
-          condition
-        when BSON::Regexp::Raw
-          condition.compile
-        else
+      module_function def matches?(_exists, value, condition)
+        unless condition.is_a?(Regexp) || condition.is_a?(BSON::Regexp::Raw)
           # Note that strings must have been converted to a regular expression
           # instance already (with $options taken into account, if provided).
           raise Errors::InvalidQuery, "$regex requires a regular expression argument: #{Errors::InvalidQuery.truncate_expr(condition)}"
         end
 
+        # The condition is compiled by RegexpBudget rather than here, so that
+        # the budget's timeout can be baked into the pattern.
         case value
         when Array
+          # Object#=~ is gone as of Ruby 3.2, so an element that cannot be
+          # matched against has to be rejected rather than passed to =~.
           value.any? do |v|
-            v =~ condition
+            v.respond_to?(:=~) && RegexpBudget.match?(v, condition)
           end
         when String
-          value =~ condition
+          RegexpBudget.match?(value, condition)
         else
           false
         end
@@ -52,7 +48,7 @@ module Mongoid
       #
       # @api private
       module_function def matches_array_or_scalar?(value, condition)
-        if Array === value
+        if value.is_a?(Array)
           value.any? do |v|
             matches?(true, v, condition)
           end