mongoid 9.0.11 → 9.1.1

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -1,89 +1,84 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
-require "spec_helper"
-require_relative './selectable_shared_examples'
+require 'spec_helper'
+require_relative 'selectable_shared_examples'
 
 describe Mongoid::Criteria::Queryable::Selectable do
-
   let(:query) do
-    Mongoid::Query.new("id" => "_id")
+    Mongoid::Query.new('id' => '_id')
   end
 
-  describe "#where" do
-
+  describe '#where' do
     let(:query_method) { :where }
 
-    context "when provided no criterion" do
-
+    context 'when provided no criterion' do
       let(:selection) do
         query.where
       end
 
-      it "does not add any criterion" do
+      it 'does not add any criterion' do
         expect(selection.selector).to eq({})
       end
 
-      it "returns the query" do
+      it 'returns the query' do
         expect(selection).to eq(query)
       end
 
-      it "returns a cloned query" do
-        expect(selection).to_not equal(query)
+      it 'returns a cloned query' do
+        expect(selection).not_to equal(query)
       end
     end
 
     it_behaves_like 'requires a non-nil argument'
 
-    context "when provided a string" do
+    context 'when provided a string' do
+      # String criteria compile to $where, which requires the opt-in.
+      config_override :allow_unsafe_query_operators, true
 
       let(:selection) do
-        query.where("this.value = 10")
+        query.where('this.value = 10')
       end
 
-      it "adds the $where criterion" do
-        expect(selection.selector).to eq({ "$where" => "this.value = 10" })
+      it 'adds the $where criterion' do
+        expect(selection.selector).to eq({ '$where' => 'this.value = 10' })
       end
 
-      it "returns a cloned query" do
-        expect(selection).to_not equal(query)
+      it 'returns a cloned query' do
+        expect(selection).not_to equal(query)
       end
 
       context 'when multiple calls with string argument are made' do
-
         let(:selection) do
-          query.where("this.value = 10").where('foo.bar')
+          query.where('this.value = 10').where('foo.bar')
         end
 
         it 'combines conditions' do
           expect(selection.selector).to eq(
-            "$where" => "this.value = 10", '$and' => [{'$where' => 'foo.bar'}],
+            '$where' => 'this.value = 10', '$and' => [ { '$where' => 'foo.bar' } ]
           )
         end
       end
 
       context 'when called with string argument and with hash argument' do
-
         let(:selection) do
-          query.where("this.value = 10").where(foo: 'bar')
+          query.where('this.value = 10').where(foo: 'bar')
         end
 
         it 'combines conditions' do
           expect(selection.selector).to eq(
-            "$where" => "this.value = 10", 'foo' => 'bar',
+            '$where' => 'this.value = 10', 'foo' => 'bar'
           )
         end
       end
 
       context 'when called with hash argument and with string argument' do
-
         let(:selection) do
-          query.where(foo: 'bar').where("this.value = 10")
+          query.where(foo: 'bar').where('this.value = 10')
         end
 
         it 'combines conditions' do
           expect(selection.selector).to eq(
-            'foo' => 'bar', "$where" => "this.value = 10",
+            'foo' => 'bar', '$where' => 'this.value = 10'
           )
         end
       end
@@ -91,46 +86,41 @@ describe Mongoid::Criteria::Queryable::Selectable do
       context 'when called with two hash arguments' do
         context 'when arguments use operators' do
           shared_examples 'combines conditions' do
-
             it 'combines conditions' do
               expect(selection.selector).to eq(
-                'foo' => {'$in' => [1]},
-                '$and' => ['foo' => {'$in' => [2]}],
+                'foo' => { '$in' => [ 1 ] },
+                '$and' => [ { 'foo' => { '$in' => [ 2 ] } } ]
               )
             end
           end
 
           context 'string operators' do
-
             let(:selection) do
-              query.where(foo: {'$in' => [1]}).where(foo: {'$in' => [2]})
+              query.where(foo: { '$in' => [ 1 ] }).where(foo: { '$in' => [ 2 ] })
             end
 
             include_examples 'combines conditions'
           end
 
           context 'symbol operators' do
-
             let(:selection) do
-              query.where(foo: {:$in => [1]}).where(foo: {:$in => [2]})
+              query.where(foo: { :$in => [ 1 ] }).where(foo: { :$in => [ 2 ] })
             end
 
             include_examples 'combines conditions'
           end
 
           context 'string and symbol operators' do
-
             let(:selection) do
-              query.where(foo: {'$in' => [1]}).where(foo: {:$in => [2]})
+              query.where(foo: { '$in' => [ 1 ] }).where(foo: { :$in => [ 2 ] })
             end
 
             include_examples 'combines conditions'
           end
 
           context 'symbol and string operators' do
-
             let(:selection) do
-              query.where(foo: {:$in => [1]}).where(foo: {'$in' => [2]})
+              query.where(foo: { :$in => [ 1 ] }).where(foo: { '$in' => [ 2 ] })
             end
 
             include_examples 'combines conditions'
@@ -139,26 +129,24 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
 
-    context "when provided a single criterion" do
-
-      context "when the value needs no evolution" do
-
+    context 'when provided a single criterion' do
+      context 'when the value needs no evolution' do
         let(:selection) do
-          query.where(name: "Syd")
+          query.where(name: 'Syd')
         end
 
-        it "adds the criterion to the selection" do
-          expect(selection.selector).to eq({ "name" => "Syd" })
+        it 'adds the criterion to the selection' do
+          expect(selection.selector).to eq({ 'name' => 'Syd' })
         end
       end
 
-      context "when the value must be evolved" do
-
+      context 'when the value must be evolved' do
         before(:all) do
           class Document
             def id
               13
             end
+
             def self.evolve(object)
               object.id
             end
@@ -169,10 +157,9 @@ describe Mongoid::Criteria::Queryable::Selectable do
           Object.send(:remove_const, :Document)
         end
 
-        context "when the key needs evolution" do
-
+        context 'when the key needs evolution' do
           let(:query) do
-            Mongoid::Query.new({ "user" => "user_id" })
+            Mongoid::Query.new({ 'user' => 'user_id' })
           end
 
           let(:document) do
@@ -183,13 +170,12 @@ describe Mongoid::Criteria::Queryable::Selectable do
             query.where(user: document)
           end
 
-          it "alters the key and value" do
-            expect(selection.selector).to eq({ "user_id" => document.id })
+          it 'alters the key and value' do
+            expect(selection.selector).to eq({ 'user_id' => document.id })
           end
         end
 
         context 'when the field is a String and the value is a BSON::Regexp::Raw' do
-
           let(:raw_regexp) do
             BSON::Regexp::Raw.new('^Em')
           end
@@ -199,338 +185,314 @@ describe Mongoid::Criteria::Queryable::Selectable do
           end
 
           it 'does not convert the bson raw regexp object to a String' do
-            expect(selection.selector).to eq({ "_id" => raw_regexp })
+            expect(selection.selector).to eq({ '_id' => raw_regexp })
           end
         end
       end
     end
 
-    context "when provided complex criterion" do
-
-      context "when performing an $all" do
-
-        context "when performing a single query" do
-
+    context 'when provided complex criterion' do
+      context 'when performing an $all' do
+        context 'when performing a single query' do
           let(:selection) do
             query.where(:field.all => [ 1, 2 ])
           end
 
-          it "adds the $all criterion" do
-            expect(selection.selector).to eq({ "field" => { "$all" => [ 1, 2 ] }})
+          it 'adds the $all criterion' do
+            expect(selection.selector).to eq({ 'field' => { '$all' => [ 1, 2 ] } })
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
       end
 
-      context "when performing an $elemMatch" do
-
-        context "when the value is not complex" do
-
+      context 'when performing an $elemMatch' do
+        context 'when the value is not complex' do
           let(:selection) do
             query.where(:field.elem_match => { key: 1 })
           end
 
-          it "adds the $elemMatch criterion" do
+          it 'adds the $elemMatch criterion' do
             expect(selection.selector).to eq(
-              { "field" => { "$elemMatch" => { 'key' => 1 } }}
+              { 'field' => { '$elemMatch' => { 'key' => 1 } } }
             )
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
 
-        context "when the value is complex" do
-
+        context 'when the value is complex' do
           let(:selection) do
             query.where(:field.elem_match => { :key.gt => 1 })
           end
 
-          it "adds the $elemMatch criterion" do
+          it 'adds the $elemMatch criterion' do
             expect(selection.selector).to eq(
-              { "field" => { "$elemMatch" => { "key" => { "$gt" => 1 }}}}
+              { 'field' => { '$elemMatch' => { 'key' => { '$gt' => 1 } } } }
             )
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
       end
 
-      context "when performing an $exists" do
-
-        context "when providing boolean values" do
-
+      context 'when performing an $exists' do
+        context 'when providing boolean values' do
           let(:selection) do
             query.where(:field.exists => true)
           end
 
-          it "adds the $exists criterion" do
+          it 'adds the $exists criterion' do
             expect(selection.selector).to eq(
-              { "field" => { "$exists" => true }}
+              { 'field' => { '$exists' => true } }
             )
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
 
-        context "when providing string values" do
-
+        context 'when providing string values' do
           let(:selection) do
-            query.where(:field.exists => "t")
+            query.where(:field.exists => 't')
           end
 
-          it "adds the $exists criterion" do
+          it 'adds the $exists criterion' do
             expect(selection.selector).to eq(
-              { "field" => { "$exists" => true }}
+              { 'field' => { '$exists' => true } }
             )
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
       end
 
-      context "when performing a $gt" do
-
+      context 'when performing a $gt' do
         let(:selection) do
           query.where(:field.gt => 10)
         end
 
-        it "adds the $gt criterion" do
+        it 'adds the $gt criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$gt" => 10 }}
+            { 'field' => { '$gt' => 10 } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $gte" do
-
+      context 'when performing a $gte' do
         let(:selection) do
           query.where(:field.gte => 10)
         end
 
-        it "adds the $gte criterion" do
+        it 'adds the $gte criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$gte" => 10 }}
+            { 'field' => { '$gte' => 10 } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing an $in" do
-
+      context 'when performing an $in' do
         let(:selection) do
           query.where(:field.in => [ 1, 2 ])
         end
 
-        it "adds the $in criterion" do
-          expect(selection.selector).to eq({ "field" => { "$in" => [ 1, 2 ] }})
+        it 'adds the $in criterion' do
+          expect(selection.selector).to eq({ 'field' => { '$in' => [ 1, 2 ] } })
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $lt" do
-
+      context 'when performing a $lt' do
         let(:selection) do
           query.where(:field.lt => 10)
         end
 
-        it "adds the $lt criterion" do
+        it 'adds the $lt criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$lt" => 10 }}
+            { 'field' => { '$lt' => 10 } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $lte" do
-
+      context 'when performing a $lte' do
         let(:selection) do
           query.where(:field.lte => 10)
         end
 
-        it "adds the $lte criterion" do
+        it 'adds the $lte criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$lte" => 10 }}
+            { 'field' => { '$lte' => 10 } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $mod" do
-
+      context 'when performing a $mod' do
         let(:selection) do
           query.where(:field.mod => [ 10, 1 ])
         end
 
-        it "adds the $lte criterion" do
+        it 'adds the $lte criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$mod" => [ 10, 1 ]}}
+            { 'field' => { '$mod' => [ 10, 1 ] } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $ne" do
-
+      context 'when performing a $ne' do
         let(:selection) do
           query.where(:field.ne => 10)
         end
 
-        it "adds the $ne criterion" do
+        it 'adds the $ne criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$ne" => 10 }}
+            { 'field' => { '$ne' => 10 } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $near" do
-
+      context 'when performing a $near' do
         let(:selection) do
           query.where(:field.near => [ 1, 1 ])
         end
 
-        it "adds the $near criterion" do
+        it 'adds the $near criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$near" => [ 1, 1 ] }}
+            { 'field' => { '$near' => [ 1, 1 ] } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $nearSphere" do
-
+      context 'when performing a $nearSphere' do
         let(:selection) do
           query.where(:field.near_sphere => [ 1, 1 ])
         end
 
-        it "adds the $nearSphere criterion" do
+        it 'adds the $nearSphere criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$nearSphere" => [ 1, 1 ] }}
+            { 'field' => { '$nearSphere' => [ 1, 1 ] } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $nin" do
-
+      context 'when performing a $nin' do
         let(:selection) do
           query.where(:field.nin => [ 1, 2 ])
         end
 
-        it "adds the $nin criterion" do
-          expect(selection.selector).to eq({ "field" => { "$nin" => [ 1, 2 ] }})
+        it 'adds the $nin criterion' do
+          expect(selection.selector).to eq({ 'field' => { '$nin' => [ 1, 2 ] } })
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $not" do
-
+      context 'when performing a $not' do
         let(:selection) do
           query.where(:field.not => /test/)
         end
 
-        it "adds the $not criterion" do
-          expect(selection.selector).to eq({ "field" => { "$not" => /test/ }})
+        it 'adds the $not criterion' do
+          expect(selection.selector).to eq({ 'field' => { '$not' => /test/ } })
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
 
-      context "when performing a $size" do
-
-        context "when providing an integer" do
-
+      context 'when performing a $size' do
+        context 'when providing an integer' do
           let(:selection) do
             query.where(:field.with_size => 10)
           end
 
-          it "adds the $size criterion" do
+          it 'adds the $size criterion' do
             expect(selection.selector).to eq(
-              { "field" => { "$size" => 10 }}
+              { 'field' => { '$size' => 10 } }
             )
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
 
-        context "when providing a string" do
-
+        context 'when providing a string' do
           let(:selection) do
-            query.where(:field.with_size => "10")
+            query.where(:field.with_size => '10')
           end
 
-          it "adds the $size criterion" do
+          it 'adds the $size criterion' do
             expect(selection.selector).to eq(
-              { "field" => { "$size" => 10 }}
+              { 'field' => { '$size' => 10 } }
             )
           end
 
-          it "returns a cloned query" do
-            expect(selection).to_not eq(query)
+          it 'returns a cloned query' do
+            expect(selection).not_to eq(query)
           end
         end
       end
 
-      context "when performing a $type" do
-
+      context 'when performing a $type' do
         let(:selection) do
           query.where(:field.with_type => 10)
         end
 
-        it "adds the $type criterion" do
+        it 'adds the $type criterion' do
           expect(selection.selector).to eq(
-            { "field" => { "$type" => 10 }}
+            { 'field' => { '$type' => 10 } }
           )
         end
 
-        it "returns a cloned query" do
-          expect(selection).to_not eq(query)
+        it 'returns a cloned query' do
+          expect(selection).not_to eq(query)
         end
       end
     end
@@ -541,24 +503,28 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
 
       let(:selection) do
-        base_query.where(mql_operator => ['hello' => 'world'])
+        base_query.where(mql_operator => [ { 'hello' => 'world' } ])
       end
 
       shared_examples_for 'adds conditions to existing query' do
         it 'adds conditions to existing query' do
-          selection.selector.should == {
-            'test' => 1,
-            mql_operator => ['hello' => 'world'],
-          }
+          selection.selector.should eq(
+            {
+              'test' => 1,
+              mql_operator => [ { 'hello' => 'world' } ]
+            }
+          )
         end
       end
 
       shared_examples_for 'adds conditions to existing query with an extra $and' do
         it 'adds conditions to existing query' do
-          selection.selector.should == {
-            'test' => 1,
-            mql_operator => ['hello' => 'world'],
-          }
+          selection.selector.should eq(
+            {
+              'test' => 1,
+              mql_operator => [ { 'hello' => 'world' } ]
+            }
+          )
         end
       end
 
@@ -587,4 +553,202 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
+
+  describe 'top-level operator injection guard' do
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      context 'when passing $where' do
+        it 'does not raise' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing $function' do
+        it 'does not raise' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'does not raise' do
+          expect do
+            query.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'does not raise' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      context 'when passing $where' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      context 'when passing $function' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
+        end
+      end
+
+      context 'when the error mentions allow_unsafe_query_operators' do
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('$where' => 'true')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
+        context "when passing #{op} (allowlisted)" do
+          it 'does not raise' do
+            value = case op
+                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
+                    when '$text' then { '$search' => 'hi' }
+                    when '$expr' then { '$gt' => [ '$a', 1 ] }
+                    when '$jsonSchema' then { 'required' => [ 'x' ] }
+                    else true
+                    end
+            expect { query.where(op => value) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
+  describe 'nested operator injection guard' do
+    js = 'this.name == "admin"'
+
+    function_expr = {
+      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
+    }.freeze
+
+    accumulator_expr = {
+      '$accumulator' => {
+        'init' => 'function() { return 0; }',
+        'accumulate' => 'function() { return 0; }',
+        'accumulateArgs' => [],
+        'merge' => 'function() { return 0; }',
+        'lang' => 'js'
+      }
+    }.freeze
+
+    # Every path into the selector that does not route through #expr_query,
+    # plus the nested forms that a top-level key check cannot see.
+    unsafe_queries = {
+      'and with a $where key' => ->(query) { query.and('$where' => js) },
+      'or with a $where key' => ->(query) { query.or('$where' => js) },
+      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
+      'not with a $where key' => ->(query) { query.not('$where' => js) },
+      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
+      'none_of with a $where key' => ->(query) { query.none_of('$where' => js) },
+      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
+      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
+      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
+      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
+      'where with $where three levels deep' => lambda { |query|
+        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
+      },
+      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
+    }.freeze
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'raises InvalidQuery' do
+            expect do
+              builder.call(query)
+            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
+          end
+        end
+      end
+
+      it 'includes the config opt-in in the message' do
+        expect do
+          query.or('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+      end
+
+      context 'when the nested expression is safe' do
+        it 'permits $or with field expressions' do
+          expect do
+            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
+          end.not_to raise_error
+        end
+
+        it 'permits $expr with aggregation operators' do
+          expect do
+            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
+          end.not_to raise_error
+        end
+
+        it 'permits a field whose name resembles a javascript operator' do
+          expect do
+            query.where('where' => js)
+          end.not_to raise_error
+        end
+
+        it 'permits a value that resembles a javascript operator' do
+          expect do
+            query.where('name' => '$where')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'does not raise' do
+            expect { builder.call(query) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
 end