mongoid 9.0.11 → 9.1.1

data/spec/integration/persistence/range_field_spec.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 require 'spec_helper'
 
 describe 'Range field persistence' do
-  let!(:person) { Person.create!(field => value).reload }
   subject { person.send(field) }
+
+  let!(:person) { Person.create!(field => value).reload }
   let(:now_utc) { Time.now }
   let(:later_utc) { now_utc + 10.minutes }
   let(:now_in_zone) { now_utc.in_time_zone('Asia/Tokyo') }
@@ -16,6 +16,7 @@ describe 'Range field persistence' do
 
     context 'when Integer' do
       let(:value) { 1..3 }
+
       it do
         expect(subject).to eq(1..3)
       end
@@ -23,50 +24,59 @@ describe 'Range field persistence' do
 
     context 'when Integer exclude_end' do
       let(:value) { 1...3 }
+
       it { expect(subject).to eq(1...3) }
     end
 
     context 'when endless' do
       ruby_version_gte '2.6'
       let(:value) { eval('3..') }
+
       it { expect(subject).to eq(eval('3..')) }
     end
 
     context 'when endless exclude_end' do
       ruby_version_gte '2.6'
       let(:value) { eval('3...') }
+
       it { expect(subject).to eq(eval('3...')) }
     end
 
     context 'when beginning-less' do
       ruby_version_gte '2.7'
       let(:value) { eval('..3') }
+
       it { expect(subject).to eq(eval('..3')) }
     end
 
     context 'when beginning-less exclude_end' do
       ruby_version_gte '2.7'
       let(:value) { eval('...3') }
+
       it { expect(subject).to eq(eval('...3')) }
     end
 
     context 'when Hash<String, Integer>' do
       let(:value) { { 'min' => 1, 'max' => 3 } }
+
       it { expect(subject).to eq(1..3) }
     end
 
     context 'when Hash<String, Integer> exclude_end' do
       let(:value) { { 'min' => 1, 'max' => 3, 'exclude_end' => true } }
+
       it { expect(subject).to eq(1...3) }
     end
 
     context 'when Hash<Symbol, Integer>' do
       let(:value) { { min: 1, max: 3 } }
+
       it { expect(subject).to eq(1..3) }
     end
 
     context 'when Hash<Symbol, Integer> exclude_end' do
       let(:value) { { min: 1, max: 3, exclude_end: true } }
+
       it { expect(subject).to eq(1...3) }
     end
 
@@ -180,6 +190,7 @@ describe 'Range field persistence' do
 
     context 'when Integer' do
       let(:value) { 1..3 }
+
       it do
         expect(subject).to eq('max' => 3, 'min' => 1)
       end
@@ -187,60 +198,71 @@ describe 'Range field persistence' do
 
     context 'when Integer exclude_end' do
       let(:value) { 1...3 }
+
       it { expect(subject).to eq('max' => 3, 'min' => 1, 'exclude_end' => true) }
     end
 
     context 'when descending' do
       let(:value) { 3..1 }
+
       it { expect(subject).to eq('max' => 1, 'min' => 3) }
     end
 
     context 'when descending exclude_end' do
       let(:value) { 3...1 }
+
       it { expect(subject).to eq('max' => 1, 'min' => 3, 'exclude_end' => true) }
     end
 
     context 'when endless' do
       ruby_version_gte '2.6'
       let(:value) { eval('3..') }
+
       it { expect(subject).to eq('min' => 3) }
     end
 
     context 'when endless exclude_end' do
       ruby_version_gte '2.6'
       let(:value) { eval('3...') }
+
       it { expect(subject).to eq('min' => 3, 'exclude_end' => true) }
     end
 
     context 'when beginning-less' do
       ruby_version_gte '2.7'
       let(:value) { eval('..3') }
+
       it { expect(subject).to eq('max' => 3) }
     end
 
     context 'when beginning-less exclude_end' do
       ruby_version_gte '2.7'
       let(:value) { eval('...3') }
+
       it { expect(subject).to eq('max' => 3, 'exclude_end' => true) }
     end
 
     context 'when Hash<String, Integer>' do
       let(:value) { { 'min' => 1, 'max' => 3 } }
+
       it { expect(subject).to eq('max' => 3, 'min' => 1) }
     end
 
     context 'when Hash<String, Integer> exclude_end' do
       let(:value) { { 'min' => 1, 'max' => 3, 'exclude_end' => true } }
+
       it { expect(subject).to eq('max' => 3, 'min' => 1, 'exclude_end' => true) }
     end
 
     context 'when Hash<Symbol, Integer>' do
       let(:value) { { min: 1, max: 3 } }
+
       it { expect(subject).to eq('max' => 3, 'min' => 1) }
     end
 
     context 'when Hash<Symbol, Integer> exclude_end' do
       let(:value) { { min: 1, max: 3, exclude_end: true } }
+
       it { expect(subject).to eq('max' => 3, 'min' => 1, 'exclude_end' => true) }
     end
 

data/spec/integration/query_operator_guard_spec.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'query operator injection guard' do
+  let(:js) { 'this.name == "admin"' }
+
+  let(:nested_function) do
+    { '$expr' => { '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' } } }
+  end
+
+  let(:band) { Band.create!(name: 'Depeche Mode') }
+
+  context 'with default configuration' do
+    it 'rejects unsafe operators without any opt-out' do
+      expect(Mongoid.allow_unsafe_query_operators).to be false
+    end
+
+    context 'when querying with where' do
+      it 'rejects a top-level $where' do
+        expect { Band.where('$where' => js).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'rejects a $function nested in $expr' do
+        expect { Band.where(nested_function).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'permits an ordinary query' do
+        expect(Band.where(name: band.name).first).to eq(band)
+      end
+    end
+
+    context 'when querying with find_by' do
+      it 'rejects a top-level $where' do
+        expect { Band.find_by('$where' => js) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'rejects a $function nested in $expr' do
+        expect { Band.find_by(nested_function) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying with find_or_create_by' do
+      it 'rejects a top-level $where' do
+        expect { Band.find_or_create_by('$where' => js) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying with find_or_initialize_by' do
+      it 'rejects a top-level $where' do
+        expect { Band.find_or_initialize_by('$where' => js) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying an association with find_or_create_by' do
+      it 'rejects a top-level $where' do
+        expect do
+          band.records.find_or_create_by('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying with a logical operator' do
+      it 'rejects a $where smuggled through or' do
+        expect { Band.or('$where' => js).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'rejects a $where smuggled through any_of' do
+        expect { Band.any_of('$where' => js).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+  end
+
+  context 'when allow_unsafe_query_operators is true' do
+    config_override :allow_unsafe_query_operators, true
+
+    it 'permits a top-level $where' do
+      expect(Band.where('$where' => "this.name == '#{band.name}'").first).to eq(band)
+    end
+
+    it 'permits a $function nested in $expr' do
+      expect { Band.where(nested_function).first }.not_to raise_error
+    end
+
+    it 'permits a $where smuggled through or' do
+      expect { Band.or('$where' => js).first }.not_to raise_error
+    end
+  end
+end

data/spec/integration/server_query_spec.rb

@@ -1,27 +1,25 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 require 'spec_helper'
 
 # This file serves as a record of server query behavior.
 
 describe 'Server queries' do
-
   context 'scalar operator on scalar field' do
     let!(:document) do
       Survey.create!(
-        questions: [Question.new(
-          answers: [Answer.new(position: 3)],
-        )],
+        questions: [ Question.new(
+          answers: [ Answer.new(position: 3) ]
+        ) ]
       )
     end
 
     let(:query) do
-      {'questions.answers.position' => {'$gt' => 2}}
+      { 'questions.answers.position' => { '$gt' => 2 } }
     end
 
     it 'finds' do
-      Survey.collection.find(query).to_a.should == [document.attributes]
+      Survey.collection.find(query).to_a.should eq [ document.attributes ]
     end
   end
 
@@ -29,53 +27,55 @@ describe 'Server queries' do
     let!(:document) do
       Bar.create!(
         questions: [
-          answers: [
-            position: [3],
-          ],
-        ],
+          {
+            answers: [
+              { position: [ 3 ] }
+            ]
+          }
+        ]
       )
     end
 
     context '$eq with scalar on array field' do
       let(:query) do
-        {'questions.answers.position' => {'$eq' => 3}}
+        { 'questions.answers.position' => { '$eq' => 3 } }
       end
 
       it 'finds' do
-        Bar.collection.find(query).to_a.should == [document.attributes.with_indifferent_access]
+        Bar.collection.find(query).to_a.should eq [ document.attributes.with_indifferent_access ]
       end
     end
 
     context '$ne with scalar on array field' do
       context 'same value as array item' do
         let(:query) do
-          {'questions.answers.position' => {'$ne' => 3}}
+          { 'questions.answers.position' => { '$ne' => 3 } }
         end
 
         it 'matches array and does not find' do
-          Bar.collection.find(query).to_a.should == []
+          Bar.collection.find(query).to_a.should eq []
         end
       end
 
       context 'different value from array items' do
         let(:query) do
-          {'questions.answers.position' => {'$ne' => 2}}
+          { 'questions.answers.position' => { '$ne' => 2 } }
         end
 
         it 'finds' do
-          Bar.collection.find(query).to_a.should == [document.attributes.with_indifferent_access]
+          Bar.collection.find(query).to_a.should eq [ document.attributes.with_indifferent_access ]
         end
       end
     end
 
     context '$gt on array field' do
       let(:query) do
-        {'questions.answers.position' => {'$gt' => 2}}
+        { 'questions.answers.position' => { '$gt' => 2 } }
       end
 
       it 'finds' do
         # This finds the document - https://jira.mongodb.org/browse/DOCSP-10717
-        Bar.collection.find(query).to_a.should == [document.attributes.with_indifferent_access]
+        Bar.collection.find(query).to_a.should eq [ document.attributes.with_indifferent_access ]
       end
     end
 
@@ -83,19 +83,21 @@ describe 'Server queries' do
       let!(:document) do
         Bar.create!(
           questions: [
-            answers: [
-              position: [[3]],
-            ],
-          ],
+            {
+              answers: [
+                { position: [ [ 3 ] ] }
+              ]
+            }
+          ]
         )
       end
 
       let(:query) do
-        {'questions.answers.position' => {'$in' => [3]}}
+        { 'questions.answers.position' => { '$in' => [ 3 ] } }
       end
 
       it 'does not find' do
-        Bar.collection.find(query).to_a.should == []
+        Bar.collection.find(query).to_a.should eq []
       end
     end
 
@@ -103,19 +105,21 @@ describe 'Server queries' do
       let!(:document) do
         Bar.create!(
           questions: [
-            answers: [
-              position: [3],
-            ],
-          ],
+            {
+              answers: [
+                { position: [ 3 ] }
+              ]
+            }
+          ]
         )
       end
 
       let(:query) do
-        {'questions.answers.position' => {'$in' => [3]}}
+        { 'questions.answers.position' => { '$in' => [ 3 ] } }
       end
 
       it 'finds' do
-        Bar.collection.find(query).to_a.should == [document.attributes.with_indifferent_access]
+        Bar.collection.find(query).to_a.should eq [ document.attributes.with_indifferent_access ]
       end
     end
 
@@ -123,19 +127,21 @@ describe 'Server queries' do
       let!(:document) do
         Bar.create!(
           questions: [
-            answers: [
-              position: 3,
-            ],
-          ],
+            {
+              answers: [
+                { position: 3 }
+              ]
+            }
+          ]
         )
       end
 
       let(:query) do
-        {'questions.answers.position' => {'$in' => [3]}}
+        { 'questions.answers.position' => { '$in' => [ 3 ] } }
       end
 
       it 'finds' do
-        Bar.collection.find(query).to_a.should == [document.attributes.with_indifferent_access]
+        Bar.collection.find(query).to_a.should eq [ document.attributes.with_indifferent_access ]
       end
     end
   end

data/spec/integration/shardable_spec.rb

@@ -1,24 +1,24 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 require 'spec_helper'
 require_relative '../mongoid/shardable_models'
 
 describe 'Sharding helpers' do
   require_topology :sharded
+  min_server_version '4.4'
 
   describe 'shard_collection rake task' do
     let(:shard_collections) do
-      Mongoid::Tasks::Database.shard_collections([model_cls])
+      Mongoid::Tasks::Database.shard_collections([ model_cls ])
     end
 
     let(:create_indexes) do
-      Mongoid::Tasks::Database.create_indexes([model_cls])
+      Mongoid::Tasks::Database.create_indexes([ model_cls ])
     end
 
     shared_examples_for 'shards collection' do
       it 'returns the model class' do
-        shard_collections.should == [model_cls]
+        shard_collections.should eq [ model_cls ]
       end
 
       it 'shards collection' do
@@ -47,6 +47,8 @@ describe 'Sharding helpers' do
     end
 
     context 'when database does not exist' do
+      max_server_version '8.2.99'
+
       let(:model_cls) { SmMovie }
 
       before do
@@ -60,8 +62,6 @@ describe 'Sharding helpers' do
       let(:model_cls) { SmMovie }
 
       before do
-        SmMovie.collection.database.drop
-        SmMovie.collection.create
         SmMovie.collection.drop
       end
 
@@ -72,7 +72,7 @@ describe 'Sharding helpers' do
       let(:model_cls) { SmMovie }
 
       before do
-        Mongoid::Tasks::Database.shard_collections([model_cls])
+        Mongoid::Tasks::Database.shard_collections([ model_cls ])
       end
 
       it_behaves_like 'shards collection'
@@ -99,7 +99,7 @@ describe 'Sharding helpers' do
       let(:model_cls) { SmActor }
 
       it 'returns empty array' do
-        shard_collections.should == []
+        shard_collections.should eq []
       end
 
       it 'does not shards collection' do
@@ -108,18 +108,17 @@ describe 'Sharding helpers' do
         stats = model_cls.collection.database.command(collStats: model_cls.collection.name).first
         stats[:sharded].should be false
       end
-
     end
 
     context 'when models have no sharded configuration' do
       let(:model_cls) { SmNotSharded }
 
       before do
-        model_cls.shard_config.should be nil
+        model_cls.shard_config.should be_nil
       end
 
       it 'returns empty array' do
-        shard_collections.should == []
+        shard_collections.should eq []
       end
 
       context 'pre-4.2' do

data/spec/integration/stringified_symbol_field_spec.rb

@@ -5,6 +5,34 @@ describe "StringifiedSymbol fields" do
 
   before do
     Order.destroy_all
+    client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+    subscriber.clear_events!
+
+    document1
+    document2
+  end
+
+  after do
+    client.unsubscribe(Mongo::Monitoring::COMMAND, subscriber)
+  end
+
+  # Using command monitoring to test that StringifiedSymbol sends a string and returns a symbol
+  let(:client) { Order.collection.client }
+  let(:query) { {'saved_status' => {'$eq' => 'test'}} }
+  let(:document1) { Order.create!(saved_status: :test) }
+  let(:document2) { Order.where(query).first }
+  let(:subscriber) { EventSubscriber.new }
+
+  let(:find_events) do
+    subscriber.started_events.select { |event| event.command_name.to_s == 'find' }
+  end
+
+  let(:insert_events) do
+    subscriber.started_events.select { |event| event.command_name.to_s == 'insert' }
+  end
+
+  let(:update_events) do
+    subscriber.started_events.select { |event| event.command_name.to_s == 'update' }
   end
 
   context "when querying the database" do
@@ -32,49 +60,6 @@ describe "StringifiedSymbol fields" do
     end
   end
 
-  # Using command monitoring to test that StringifiedSymbol sends a string and returns a symbol
-  let(:client) { Order.collection.client }
-
-  before do
-    client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
-  end
-
-  after do
-    client.unsubscribe(Mongo::Monitoring::COMMAND, subscriber)
-  end
-
-  let(:subscriber) do
-    EventSubscriber.new
-  end
-
-  let(:find_events) do
-    subscriber.started_events.select { |event| event.command_name.to_s == 'find' }
-  end
-
-  let(:insert_events) do
-    subscriber.started_events.select { |event| event.command_name.to_s == 'insert' }
-  end
-
-  let(:update_events) do
-    subscriber.started_events.select { |event| event.command_name.to_s == 'update' }
-  end
-
-  before do
-    subscriber.clear_events!
-  end
-
-  let(:query) do
-    {'saved_status' => {'$eq' => 'test'}}
-  end
-
-  let!(:document1) do
-    Order.create!(saved_status: :test)
-  end
-
-  let!(:document2) do
-    Order.where(query).first
-  end
-
   context "when inserting document" do
 
     it "sends the value as a string" do

data/spec/lite_spec_helper.rb

@@ -1,13 +1,12 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 $LOAD_PATH.unshift(File.dirname(__FILE__))
-$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), "..", "lib"))
-$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), "shared", "lib"))
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), 'shared', 'lib'))
 
 # Load byebug before mongoid, to place breakpoints in the lib methods.
 # But SpecConfig needs the driver code - require the driver here.
-require "mongo"
+require 'mongo'
 
 # MRI 2.5 and JRuby 9.2 change visibility of Object#pp when 'pp' is required,
 # which happens when RSpec reports anything. This creates an issue for tests
@@ -21,9 +20,9 @@ require 'support/spec_config'
 require 'mrss/lite_constraints'
 
 if Gem::Version.new(Mongo::VERSION) < Gem::Version.new('2.18.0.alpha')
-  require "mrss/session_registry_legacy"
+  require 'mrss/session_registry_legacy'
 else
-  require "mrss/session_registry"
+  require 'mrss/session_registry'
 end
 
 Mrss.patch_mongo_for_session_registry
@@ -53,7 +52,7 @@ end
 
 STANDARD_TIMEOUTS = {
   app: 500, # App tests under JRuby take a REALLY long time (over 5 minutes per test).
-  default: 30,
+  default: 30
 }.freeze
 
 def timeout_type
@@ -75,24 +74,24 @@ end
 
 RSpec.configure do |config|
   config.expect_with(:rspec) do |c|
-    c.syntax = [:should, :expect]
+    c.syntax = %i[should expect]
   end
 
   if SpecConfig.instance.ci?
     config.add_formatter(RSpec::Core::Formatters::JsonFormatter, File.join(File.dirname(__FILE__), '../tmp/rspec.json'))
   end
 
-  if SpecConfig.instance.ci? && !%w(1 true yes).include?(ENV['INTERACTIVE']&.downcase)
-    config.around(:each) do |example|
+  if SpecConfig.instance.ci? && !%w[1 true yes].include?(ENV['INTERACTIVE']&.downcase)
+    config.around do |example|
       TimeoutInterrupt.timeout(example_timeout_seconds) do
         example.run
       end
     end
   end
 
-  def local_env(env = nil, &block)
+  def local_env(env = nil)
     around do |example|
-      env ||= block.call
+      env ||= yield
       saved_env = ENV.to_h
       ENV.update(env)