mongoid 9.0.11 → 9.0.12

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -36,6 +36,8 @@ describe Mongoid::Criteria::Queryable::Selectable do
     it_behaves_like 'requires a non-nil argument'
 
     context "when provided a string" do
+      # String criteria compile to $where, which requires the opt-in.
+      config_override :allow_unsafe_query_operators, true
 
       let(:selection) do
         query.where("this.value = 10")
@@ -587,4 +589,202 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
+
+  describe 'top-level operator injection guard' do
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      context 'when passing $where' do
+        it 'does not raise' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'does not raise' do
+          expect do
+            query.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'does not raise' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing $function' do
+        it 'does not raise' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      context 'when passing $where' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      context 'when passing $function' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
+        end
+      end
+
+      context 'when the error mentions allow_unsafe_query_operators' do
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('$where' => 'true')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
+        context "when passing #{op} (allowlisted)" do
+          it 'does not raise' do
+            value = case op
+                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
+                    when '$text' then { '$search' => 'hi' }
+                    when '$expr' then { '$gt' => [ '$a', 1 ] }
+                    when '$jsonSchema' then { 'required' => [ 'x' ] }
+                    else true
+                    end
+            expect { query.where(op => value) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
+  describe 'nested operator injection guard' do
+    js = 'this.name == "admin"'
+
+    function_expr = {
+      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
+    }.freeze
+
+    accumulator_expr = {
+      '$accumulator' => {
+        'init' => 'function() { return 0; }',
+        'accumulate' => 'function() { return 0; }',
+        'accumulateArgs' => [],
+        'merge' => 'function() { return 0; }',
+        'lang' => 'js'
+      }
+    }.freeze
+
+    # Every path into the selector that does not route through #expr_query,
+    # plus the nested forms that a top-level key check cannot see.
+    unsafe_queries = {
+      'and with a $where key' => ->(query) { query.and('$where' => js) },
+      'or with a $where key' => ->(query) { query.or('$where' => js) },
+      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
+      'not with a $where key' => ->(query) { query.not('$where' => js) },
+      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
+      'none_of with a $where key' => ->(query) { query.none_of('$where' => js) },
+      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
+      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
+      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
+      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
+      'where with $where three levels deep' => lambda { |query|
+        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
+      },
+      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
+    }.freeze
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'raises InvalidQuery' do
+            expect do
+              builder.call(query)
+            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
+          end
+        end
+      end
+
+      it 'includes the config opt-in in the message' do
+        expect do
+          query.or('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+      end
+
+      context 'when the nested expression is safe' do
+        it 'permits $or with field expressions' do
+          expect do
+            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
+          end.not_to raise_error
+        end
+
+        it 'permits $expr with aggregation operators' do
+          expect do
+            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
+          end.not_to raise_error
+        end
+
+        it 'permits a field whose name resembles a javascript operator' do
+          expect do
+            query.where('where' => js)
+          end.not_to raise_error
+        end
+
+        it 'permits a value that resembles a javascript operator' do
+          expect do
+            query.where('name' => '$where')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'does not raise' do
+            expect { builder.call(query) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
 end

data/spec/mongoid/criteria_spec.rb

@@ -2432,6 +2432,8 @@ describe Mongoid::Criteria do
       end
 
       context "when the criteria is not embedded" do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
 
         let(:criteria) do
           Band.where("this.name == 'Depeche Mode'")

data/spec/mongoid/encryptable_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'support/crypt/models'
+
+describe Mongoid::Encryptable do
+  describe '.requires_encryption_schema?' do
+    context 'when the model declares encrypt_with' do
+      it 'returns true' do
+        expect(Crypt::Vault.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model has an encrypted field' do
+      it 'returns true' do
+        expect(Crypt::User.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model embeds an encrypted model' do
+      it 'returns true' do
+        expect(Crypt::Wallet.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the encrypted model is nested three levels deep' do
+      it 'returns true' do
+        expect(Crypt::Owner.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model declares no encryption anywhere' do
+      it 'returns false' do
+        expect(Person.requires_encryption_schema?).to be false
+      end
+    end
+
+    # An association target does not have to be a Mongoid document. Truck
+    # embeds a plain Ruby class.
+    context 'when an embedded association target is not a document' do
+      it 'returns false' do
+        expect(Truck.requires_encryption_schema?).to be false
+      end
+    end
+
+    context 'when the model embeds itself' do
+      it 'terminates' do
+        expect(Crypt::Comment.requires_encryption_schema?).to be true
+      end
+    end
+
+    # Every model is asked this question, including ones naming an embedded
+    # class that is never defined. Such an association cannot be used, so
+    # nothing is embedded through it and nothing needs encrypting.
+    context 'when an embedded association names a class that is not defined' do
+      it 'returns false' do
+        expect(Crypt::Drawer.requires_encryption_schema?).to be false
+      end
+    end
+  end
+end