mongoid 9.0.11 → 9.0.12

data/spec/mongoid/config/encryption_spec.rb

@@ -75,6 +75,19 @@ describe Mongoid::Config::Encryption do
           end
         end
 
+        # Models are registered in class load order, and Rails eager loads
+        # app/models alphabetically, so a child whose file name sorts before
+        # its parent's arrives first.
+        context 'when the embedded model comes before its parent' do
+          let(:models) do
+            [ Crypt::Insurance, Crypt::Patient ]
+          end
+
+          it 'returns a map of encryption schemas' do
+            expect(encryption_schema_map).to eq(expected_schema_map)
+          end
+        end
+
         context 'and fields do not have encryption options' do
           let(:models) do
             [Crypt::Car]
@@ -109,6 +122,7 @@ describe Mongoid::Config::Encryption do
         let(:expected_schema_map) do
           {
             "mongoid_test.crypt_users" => {
+              'bsonType' => 'object',
               "properties" => {
                 "name" => {
                   "encrypt" => {
@@ -148,5 +162,219 @@ describe Mongoid::Config::Encryption do
         expect(encryption_schema_map).to eq({})
       end
     end
+
+    # A field left out of the schema map is written in plaintext, with no
+    # exception and nothing logged, so an omission here is silent data
+    # exposure rather than a broken feature.
+    context 'when the encrypted fields are on an embedded model' do
+      let(:token_properties) do
+        {
+          'bsonType' => 'object',
+          'properties' => {
+            'value' => {
+              'encrypt' => {
+                'bsonType' => 'string',
+                'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+              }
+            }
+          }
+        }
+      end
+
+      context 'when two models embed the same encrypted model' do
+        let(:models) do
+          [ Crypt::Vault, Crypt::Chest ]
+        end
+
+        it 'maps the embedded model for the first parent' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_vaults', 'properties', 'token'))
+            .to eq(token_properties)
+        end
+
+        it 'maps the embedded model for the second parent' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_chests', 'properties', 'token'))
+            .to eq(token_properties)
+        end
+      end
+
+      context 'when one model embeds the same encrypted model twice' do
+        let(:models) do
+          [ Crypt::Ledger ]
+        end
+
+        it 'maps the first relation' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_ledgers', 'properties', 'primary_token'))
+            .to eq(token_properties)
+        end
+
+        it 'maps the second relation' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_ledgers', 'properties', 'backup_token'))
+            .to eq(token_properties)
+        end
+      end
+
+      # relation_class constantizes, and a polymorphic embedded_in has no class
+      # to resolve, so the walk has to look at the relation type first.
+      context 'when the embedded model is embedded polymorphically' do
+        let(:models) do
+          [ Crypt::Vault ]
+        end
+
+        it 'does not raise' do
+          expect { encryption_schema_map }.not_to raise_error
+        end
+      end
+
+      context 'when the embedded model comes before its parent' do
+        let(:models) do
+          [ Crypt::Token, Crypt::Vault ]
+        end
+
+        it 'maps the embedded model' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_vaults', 'properties', 'token'))
+            .to eq(token_properties)
+        end
+      end
+
+      context 'when the parent has no encrypted field of its own' do
+        let(:models) do
+          [ Crypt::Wallet, Crypt::Token ]
+        end
+
+        it 'maps the embedded model' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_wallets', 'properties', 'token'))
+            .to eq(token_properties)
+        end
+      end
+
+      context 'when the encrypted model is nested three levels deep' do
+        let(:account_properties) do
+          {
+            'bsonType' => 'object',
+            'properties' => {
+              'credential' => {
+                'bsonType' => 'object',
+                'properties' => {
+                  'secret' => {
+                    'encrypt' => {
+                      'bsonType' => 'string',
+                      'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+                    }
+                  }
+                }
+              }
+            }
+          }
+        end
+
+        context 'when the models are listed outermost first' do
+          let(:models) do
+            [ Crypt::Owner, Crypt::Account, Crypt::Credential ]
+          end
+
+          it 'maps the whole subtree' do
+            expect(encryption_schema_map.dig('mongoid_test.crypt_owners', 'properties', 'account'))
+              .to eq(account_properties)
+          end
+        end
+
+        context 'when the middle model comes first' do
+          let(:models) do
+            [ Crypt::Account, Crypt::Owner, Crypt::Credential ]
+          end
+
+          it 'maps the whole subtree' do
+            expect(encryption_schema_map.dig('mongoid_test.crypt_owners', 'properties', 'account'))
+              .to eq(account_properties)
+          end
+        end
+      end
+
+      # The walk has to keep stopping at a model it is already inside of,
+      # otherwise a self-embedding model recurses forever.
+      context 'when a model embeds itself' do
+        let(:models) do
+          [ Crypt::Article ]
+        end
+
+        it 'terminates' do
+          expect { encryption_schema_map }.not_to raise_error
+        end
+
+        it 'maps the embedded model without descending into the cycle' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_articles', 'properties', 'comment')).to eq(
+            'bsonType' => 'object',
+            'properties' => {
+              'body' => {
+                'encrypt' => {
+                  'bsonType' => 'string',
+                  'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+                }
+              }
+            }
+          )
+        end
+      end
+    end
+
+    context 'when an encrypted model has a callable database name' do
+      let(:models) do
+        [ Crypt::DynamicCar ]
+      end
+
+      it 'does not build a key from the unresolved callable' do
+        expect(encryption_schema_map.keys.grep(/Proc/)).to be_empty
+      end
+
+      it 'does not build a key that the model can never write to' do
+        expect(encryption_schema_map.keys).to all(satisfy { |key| key.count('.') == 1 })
+      end
+    end
+
+    context 'when an encrypted model has a callable database name that needs a tenant' do
+      let(:models) do
+        [ Crypt::TenantCar ]
+      end
+
+      # Resolving the callable while the map is built is not a fix: the
+      # documented multi-tenant idiom has no correct value at client
+      # construction time. Generating the map must not depend on it.
+      it 'does not raise' do
+        expect { encryption_schema_map }.not_to raise_error
+      end
+
+      it 'does not pin the map to whichever tenant happens to be current' do
+        Thread.current[:tenant_database] = 'tenant_a'
+        expect(encryption_schema_map.keys).not_to include('tenant_a.crypt_tenant_cars')
+      ensure
+        Thread.current[:tenant_database] = nil
+      end
+    end
+
+    # The map is generated over every model in the application, and a model may
+    # name an embedded class that is never defined. Resolving that name raises,
+    # which would take down every client build.
+    context 'when a model names an embedded class that is not defined' do
+      let(:models) do
+        [ Crypt::Drawer, Crypt::Cabinet ]
+      end
+
+      it 'does not raise' do
+        expect { encryption_schema_map }.not_to raise_error
+      end
+
+      it 'leaves out the model with nothing to encrypt' do
+        expect(encryption_schema_map.keys).not_to include('mongoid_test.crypt_drawers')
+      end
+
+      it 'still maps the encrypted fields of the model itself' do
+        expect(encryption_schema_map.dig('mongoid_test.crypt_cabinets', 'properties', 'label')).to eq(
+          'encrypt' => {
+            'bsonType' => 'string',
+            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+          }
+        )
+      end
+    end
   end
 end

data/spec/mongoid/contextual/aggregable/memory_spec.rb

@@ -582,4 +582,95 @@ describe Mongoid::Contextual::Aggregable::Memory do
       end
     end
   end
+
+  context 'when the field name is a method name' do
+    let!(:depeche) do
+      Band.create!(name: 'Depeche Mode', likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it 'does not call the method for sum' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.sum(:delete)).to eq(0)
+    end
+
+    it 'does not call the method for min' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.min(:delete)).to be_nil
+    end
+
+    it 'does not call the method for max' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.max(:delete)).to be_nil
+    end
+
+    it 'does not call the method for avg' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.avg(:delete)).to be_nil
+    end
+
+    it 'does not call the method for aggregates' do
+      expect(depeche).not_to receive(:delete)
+      expect(context.aggregates(:delete))
+        .to eq('count' => 0, 'avg' => nil, 'max' => nil, 'min' => nil, 'sum' => 0)
+    end
+
+    it 'does not call a private method for avg' do
+      expect(depeche).not_to receive(:exit)
+      expect(context.avg(:exit)).to be_nil
+    end
+  end
+
+  context 'when the field is not defined' do
+    let!(:depeche) do
+      Band.create!(name: 'Depeche Mode', likes: 1000)
+    end
+
+    let(:criteria) do
+      Band.all.tap do |crit|
+        crit.documents = [ depeche ]
+      end
+    end
+
+    it 'returns zero for sum' do
+      expect(context.sum(:not_a_field)).to eq(0)
+    end
+
+    it 'returns nil for min' do
+      expect(context.min(:not_a_field)).to be_nil
+    end
+
+    it 'returns nil for max' do
+      expect(context.max(:not_a_field)).to be_nil
+    end
+
+    it 'returns nil for avg' do
+      expect(context.avg(:not_a_field)).to be_nil
+    end
+  end
+
+  context 'when the field is the foreign key of a many to many association' do
+    let!(:preference) do
+      Preference.create!(name: 'nature')
+    end
+
+    let!(:person) do
+      Person.new(preferences: [ preference ])
+    end
+
+    let(:criteria) do
+      Person.all.tap do |crit|
+        crit.documents = [ person ]
+      end
+    end
+
+    it 'aggregates the stored ids' do
+      expect(context.max(:preference_ids)).to eq([ preference.id ])
+    end
+  end
 end

data/spec/mongoid/contextual/memory_spec.rb

@@ -588,6 +588,27 @@ describe Mongoid::Contextual::Memory do
         expect(context.distinct("label.sales")).to eq([ BigDecimal("1E2") ])
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.distinct(:destroy)).to eq([ nil ])
+      end
+    end
   end
 
   describe "#each" do
@@ -1826,6 +1847,116 @@ describe Mongoid::Contextual::Memory do
         ])
       end
     end
+
+    context 'when plucking a dynamic attribute' do
+      let(:criteria) do
+        Band.all.tap do |crit|
+          crit.documents = [ Band.create!(name: 'Depeche Mode', mood: 'dark') ]
+        end
+      end
+
+      it 'returns the value from the attributes' do
+        expect(context.pluck(:mood)).to eq([ 'dark' ])
+      end
+    end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.pluck(:destroy)).to eq([ nil ])
+      end
+
+      it 'does not return the attributes hash' do
+        expect(context.pluck(:attributes)).to eq([ nil ])
+      end
+
+      it 'does not traverse to the parent document' do
+        expect(context.pluck('_root.ssn')).to eq([ nil ])
+      end
+
+      it 'does not destroy the parent document' do
+        expect(context.pluck('_root.destroy')).to eq([ nil ])
+        expect(Person.where(_id: person.id).count).to eq(1)
+      end
+    end
+
+    context 'when plucking a belongs_to association' do
+      let!(:band) do
+        Band.create!(name: 'Depeche Mode')
+      end
+
+      let!(:artist) do
+        Artist.create!(band: band)
+      end
+
+      let(:criteria) do
+        Artist.all.tap do |crit|
+          crit.documents = [ artist ]
+        end
+      end
+
+      it 'traverses to the associated document' do
+        expect(context.pluck('band.name')).to eq([ 'Depeche Mode' ])
+      end
+
+      it 'returns the document for the association name' do
+        expect(context.pluck(:band)).to eq([ band ])
+      end
+
+      it 'returns the id for the foreign key' do
+        expect(context.pluck(:band_id)).to eq([ band.id ])
+      end
+    end
+
+    context 'when plucking the foreign key of a many to many association' do
+      let!(:preference) do
+        Preference.create!(name: 'nature')
+      end
+
+      let!(:person) do
+        Person.create!(preferences: [ preference ])
+      end
+
+      let(:criteria) do
+        Person.all.tap do |crit|
+          crit.documents = [ person ]
+        end
+      end
+
+      it 'returns the stored ids' do
+        expect(context.pluck(:preference_ids)).to eq([ [ preference.id ] ])
+      end
+    end
+
+    context 'when the field path has an empty segment' do
+      let!(:band) do
+        Band.create!(name: 'Depeche Mode', label: Label.new(name: 'Mute'))
+      end
+
+      let(:criteria) do
+        Band.all.tap do |crit|
+          crit.documents = [ band ]
+        end
+      end
+
+      it 'returns nil' do
+        expect(context.pluck('label..name')).to eq([ nil ])
+      end
+    end
   end
 
   describe "#pick" do
@@ -1886,6 +2017,27 @@ describe Mongoid::Contextual::Memory do
         expect(picked).to be_nil
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.pick(:destroy)).to be_nil
+      end
+    end
   end
 
   describe "#tally" do
@@ -2340,6 +2492,31 @@ describe Mongoid::Contextual::Memory do
         )
       end
     end
+
+    context 'when the field name is a method name' do
+      let!(:person) do
+        Person.create!(ssn: 'secret-ssn')
+      end
+
+      let!(:address) do
+        person.addresses.create!(street: 'hobrecht')
+      end
+
+      let(:criteria) do
+        Address.all.tap do |crit|
+          crit.documents = [ address ]
+        end
+      end
+
+      it 'does not call the method' do
+        expect(address).not_to receive(:destroy)
+        expect(context.tally(:destroy)).to eq(nil => 1)
+      end
+
+      it 'does not disclose the parent document fields' do
+        expect(context.tally('_root.ssn')).to eq(nil => 1)
+      end
+    end
   end
 
   describe '#inc' do

data/spec/mongoid/criteria/queryable/selectable_logical_spec.rb

@@ -1830,6 +1830,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
 
       context 'when the following criteria uses string were form' do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:selection) do
           query.not.where('hello world')