mongoid 9.1.0 → 9.1.1

data/spec/mongoid/criteria/queryable/selectable_logical_spec.rb

@@ -1589,7 +1589,14 @@ describe Mongoid::Criteria::Queryable::Selectable do
   end
 
   describe '#not' do
+    # deprecated functionality
     context 'when provided no criterion' do
+      around do |example|
+        Mongoid.deprecator.silence do
+          example.run
+        end
+      end
+
       let(:selection) do
         query.not
       end
@@ -1725,6 +1732,9 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
 
       context 'when the following criteria uses string were form' do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
+
         let(:selection) do
           query.not.where('hello world')
         end
@@ -1855,9 +1865,13 @@ describe Mongoid::Criteria::Queryable::Selectable do
         it_behaves_like 'returns a cloned query'
       end
 
+      # This context tests a deprecated syntax and behavior, and must be
+      # removed when the deprecated parameterless-not syntax is removed.
       context 'when the criterion are a double negative' do
         let(:selection) do
-          query.not.where(:first.not => /1/)
+          Mongoid.deprecator.silence do
+            query.not.where(:first.not => /1/)
+          end
         end
 
         it 'does not double the $not selector' do

data/spec/mongoid/criteria/queryable/selectable_where_spec.rb

@@ -32,6 +32,9 @@ describe Mongoid::Criteria::Queryable::Selectable do
     it_behaves_like 'requires a non-nil argument'
 
     context 'when provided a string' do
+      # String criteria compile to $where, which requires the opt-in.
+      config_override :allow_unsafe_query_operators, true
+
       let(:selection) do
         query.where('this.value = 10')
       end
@@ -550,4 +553,202 @@ describe Mongoid::Criteria::Queryable::Selectable do
       end
     end
   end
+
+  describe 'top-level operator injection guard' do
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      context 'when passing $where' do
+        it 'does not raise' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing $function' do
+        it 'does not raise' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'does not raise' do
+          expect do
+            query.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'does not raise' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      context 'when passing $where' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$where' => 'this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      context 'when passing $function' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('$function' => { body: 'function() { return true; }', args: [], lang: 'js' })
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$function/)
+        end
+      end
+
+      context 'when the error mentions allow_unsafe_query_operators' do
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('$where' => 'true')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+
+        it 'includes the config opt-in in the message' do
+          expect do
+            query.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+        end
+      end
+
+      context 'when passing a string criterion to a negated query' do
+        it 'raises InvalidQuery' do
+          expect do
+            query.not.where('this.name == "admin"')
+          end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where/)
+        end
+      end
+
+      %w[$and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue].each do |op|
+        context "when passing #{op} (allowlisted)" do
+          it 'does not raise' do
+            value = case op
+                    when '$and', '$or', '$nor', '$not' then [ { 'x' => 1 } ]
+                    when '$text' then { '$search' => 'hi' }
+                    when '$expr' then { '$gt' => [ '$a', 1 ] }
+                    when '$jsonSchema' then { 'required' => [ 'x' ] }
+                    else true
+                    end
+            expect { query.where(op => value) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
+  describe 'nested operator injection guard' do
+    js = 'this.name == "admin"'
+
+    function_expr = {
+      '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' }
+    }.freeze
+
+    accumulator_expr = {
+      '$accumulator' => {
+        'init' => 'function() { return 0; }',
+        'accumulate' => 'function() { return 0; }',
+        'accumulateArgs' => [],
+        'merge' => 'function() { return 0; }',
+        'lang' => 'js'
+      }
+    }.freeze
+
+    # Every path into the selector that does not route through #expr_query,
+    # plus the nested forms that a top-level key check cannot see.
+    unsafe_queries = {
+      'and with a $where key' => ->(query) { query.and('$where' => js) },
+      'or with a $where key' => ->(query) { query.or('$where' => js) },
+      'nor with a $where key' => ->(query) { query.nor('$where' => js) },
+      'not with a $where key' => ->(query) { query.not('$where' => js) },
+      'any_of with a $where key' => ->(query) { query.any_of('$where' => js) },
+      'none_of with a $where key' => ->(query) { query.none_of('$where' => js) },
+      'elem_match with a nested $where' => ->(query) { query.elem_match(a: { '$where' => js }) },
+      'where with $where inside $or' => ->(query) { query.where('$or' => [ { '$where' => js } ]) },
+      'where with $function inside $expr' => ->(query) { query.where('$expr' => function_expr) },
+      'where with $accumulator inside $expr' => ->(query) { query.where('$expr' => accumulator_expr) },
+      'where with $where three levels deep' => lambda { |query|
+        query.where('$and' => [ { '$or' => [ { '$where' => js } ] } ])
+      },
+      'where with a symbol $where key inside $or' => ->(query) { query.where('$or' => [ { :$where => js } ]) }
+    }.freeze
+
+    context 'when allow_unsafe_query_operators is false' do
+      config_override :allow_unsafe_query_operators, false
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'raises InvalidQuery' do
+            expect do
+              builder.call(query)
+            end.to raise_error(Mongoid::Errors::InvalidQuery, /\$where|\$function|\$accumulator/)
+          end
+        end
+      end
+
+      it 'includes the config opt-in in the message' do
+        expect do
+          query.or('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery, /allow_unsafe_query_operators/)
+      end
+
+      context 'when the nested expression is safe' do
+        it 'permits $or with field expressions' do
+          expect do
+            query.where('$or' => [ { 'a' => 1 }, { 'b' => { '$gt' => 2 } } ])
+          end.not_to raise_error
+        end
+
+        it 'permits $expr with aggregation operators' do
+          expect do
+            query.where('$expr' => { '$gt' => [ '$a', '$b' ] })
+          end.not_to raise_error
+        end
+
+        it 'permits a field whose name resembles a javascript operator' do
+          expect do
+            query.where('where' => js)
+          end.not_to raise_error
+        end
+
+        it 'permits a value that resembles a javascript operator' do
+          expect do
+            query.where('name' => '$where')
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when allow_unsafe_query_operators is true' do
+      config_override :allow_unsafe_query_operators, true
+
+      unsafe_queries.each do |description, builder|
+        context "when querying with #{description}" do
+          it 'does not raise' do
+            expect { builder.call(query) }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
 end

data/spec/mongoid/criteria_spec.rb

@@ -2440,6 +2440,9 @@ describe Mongoid::Criteria do
       end
 
       context 'when the criteria is not embedded' do
+        # String criteria compile to $where, which requires the opt-in.
+        config_override :allow_unsafe_query_operators, true
+
         let(:criteria) do
           Band.where("this.name == 'Depeche Mode'")
         end

data/spec/mongoid/encryptable_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'support/crypt/models'
+
+describe Mongoid::Encryptable do
+  describe '.requires_encryption_schema?' do
+    context 'when the model declares encrypt_with' do
+      it 'returns true' do
+        expect(Crypt::Vault.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model has an encrypted field' do
+      it 'returns true' do
+        expect(Crypt::User.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model embeds an encrypted model' do
+      it 'returns true' do
+        expect(Crypt::Wallet.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the encrypted model is nested three levels deep' do
+      it 'returns true' do
+        expect(Crypt::Owner.requires_encryption_schema?).to be true
+      end
+    end
+
+    context 'when the model declares no encryption anywhere' do
+      it 'returns false' do
+        expect(Person.requires_encryption_schema?).to be false
+      end
+    end
+
+    # An association target does not have to be a Mongoid document. Truck
+    # embeds a plain Ruby class.
+    context 'when an embedded association target is not a document' do
+      it 'returns false' do
+        expect(Truck.requires_encryption_schema?).to be false
+      end
+    end
+
+    context 'when the model embeds itself' do
+      it 'terminates' do
+        expect(Crypt::Comment.requires_encryption_schema?).to be true
+      end
+    end
+
+    # Every model is asked this question, including ones naming an embedded
+    # class that is never defined. Such an association cannot be used, so
+    # nothing is embedded through it and nothing needs encrypting.
+    context 'when an embedded association names a class that is not defined' do
+      it 'returns false' do
+        expect(Crypt::Drawer.requires_encryption_schema?).to be false
+      end
+    end
+  end
+end

data/spec/mongoid/errors/config_redactor_spec.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Mongoid::Errors::ConfigRedactor do
+  describe '.redact' do
+    subject(:redacted) { described_class.redact(config) }
+
+    context 'when the config is not a hash' do
+      let(:config) { 'not a hash' }
+
+      it 'returns the value unchanged' do
+        expect(redacted).to eq('not a hash')
+      end
+    end
+
+    context 'when the config has a :password key' do
+      let(:config) { { hosts: [ 'localhost:27017' ], password: 's3cr3t' } }
+
+      it 'replaces the password value' do
+        expect(redacted[:password]).to eq('[REDACTED]')
+      end
+
+      it 'leaves other values intact' do
+        expect(redacted[:hosts]).to eq([ 'localhost:27017' ])
+      end
+    end
+
+    context 'when the config has a string "password" key' do
+      let(:config) { { 'password' => 's3cr3t' } }
+
+      it 'replaces the password value' do
+        expect(redacted['password']).to eq('[REDACTED]')
+      end
+    end
+
+    context 'when the config has a :uri with embedded credentials' do
+      let(:config) { { uri: 'mongodb://admin:s3cr3t@cluster.example.com/db' } }
+
+      it 'strips the userinfo from the URI' do
+        expect(redacted[:uri]).to eq('mongodb://[REDACTED]@cluster.example.com/db')
+      end
+    end
+
+    context 'when the config has a mongodb+srv URI' do
+      let(:config) { { uri: 'mongodb+srv://admin:s3cr3t@cluster.example.com/db' } }
+
+      it 'strips the userinfo from the URI' do
+        expect(redacted[:uri]).to eq('mongodb+srv://[REDACTED]@cluster.example.com/db')
+      end
+    end
+
+    context 'when the URI has no userinfo' do
+      let(:config) { { uri: 'mongodb://cluster.example.com/db' } }
+
+      it 'leaves the URI unchanged' do
+        expect(redacted[:uri]).to eq('mongodb://cluster.example.com/db')
+      end
+    end
+
+    context 'when the URI value is not a string' do
+      let(:config) { { uri: nil } }
+
+      it 'leaves the value unchanged' do
+        expect(redacted[:uri]).to be_nil
+      end
+    end
+
+    context 'when the config has nested auto_encryption_options' do
+      let(:kms) do
+        {
+          aws: { access_key_id: 'AKIA...', secret_access_key: 'secret-value' },
+          local: { key: 'A' * 96 }
+        }
+      end
+      let(:config) do
+        {
+          database: 'mongoid_test',
+          options: {
+            auto_encryption_options: {
+              key_vault_namespace: 'admin.datakeys',
+              kms_providers: kms
+            }
+          }
+        }
+      end
+
+      it 'redacts the entire auto_encryption_options value' do
+        expect(redacted[:options][:auto_encryption_options]).to eq('[REDACTED]')
+      end
+
+      it 'preserves sibling values in the parent hash' do
+        expect(redacted[:database]).to eq('mongoid_test')
+      end
+
+      it 'does not contain any kms secret in its serialized form' do
+        expect(redacted.to_s).not_to include('secret-value')
+        expect(redacted.to_s).not_to include('AKIA')
+        expect(redacted.to_s).not_to include('A' * 96)
+      end
+    end
+
+    context 'when redaction would mutate the input' do
+      let(:config) { { password: 's3cr3t', options: { foo: 'bar' } } }
+
+      it 'does not modify the original hash' do
+        described_class.redact(config)
+        expect(config[:password]).to eq('s3cr3t')
+      end
+    end
+  end
+end

data/spec/mongoid/errors/mixed_client_configuration_spec.rb

@@ -25,5 +25,36 @@ describe Mongoid::Errors::MixedClientConfiguration do
         'Provide either only a uri as configuration'
       )
     end
+
+    context 'when the config contains sensitive values' do
+      let(:error) do
+        described_class.new(
+          :testing,
+          {
+            uri: 'mongodb://admin:s3cr3t@cluster.example.com/db',
+            password: 'standalone-secret',
+            options: {
+              auto_encryption_options: {
+                kms_providers: { local: { key: 'A' * 96 } }
+              }
+            }
+          }
+        )
+      end
+
+      it 'redacts the URI userinfo' do
+        expect(error.message).not_to include('admin:s3cr3t')
+        expect(error.message).to include('mongodb://[REDACTED]@cluster.example.com/db')
+      end
+
+      it 'redacts the standalone password value' do
+        expect(error.message).not_to include('standalone-secret')
+      end
+
+      it 'redacts auto_encryption_options entirely' do
+        expect(error.message).not_to include('kms_providers')
+        expect(error.message).not_to include('A' * 96)
+      end
+    end
   end
 end

data/spec/mongoid/errors/no_client_database_spec.rb

@@ -25,5 +25,34 @@ describe Mongoid::Errors::NoClientDatabase do
         'If configuring via a mongoid.yml, ensure that within your :analytics'
       )
     end
+
+    context 'when the config contains sensitive values' do
+      let(:error) do
+        described_class.new(
+          :analytics,
+          {
+            hosts: [ '127.0.0.1:27017' ],
+            password: 's3cr3t',
+            options: {
+              auto_encryption_options: {
+                kms_providers: {
+                  aws: { access_key_id: 'AKIAEXAMPLE', secret_access_key: 'aws-secret' }
+                }
+              }
+            }
+          }
+        )
+      end
+
+      it 'redacts the password value' do
+        expect(error.message).not_to include('s3cr3t')
+      end
+
+      it 'redacts auto_encryption_options entirely' do
+        expect(error.message).not_to include('kms_providers')
+        expect(error.message).not_to include('aws-secret')
+        expect(error.message).not_to include('AKIAEXAMPLE')
+      end
+    end
   end
 end

data/spec/mongoid/errors/no_client_hosts_spec.rb

@@ -25,5 +25,31 @@ describe Mongoid::Errors::NoClientHosts do
         'If configuring via a mongoid.yml, ensure that within your :analytics'
       )
     end
+
+    context 'when the config contains sensitive values' do
+      let(:error) do
+        described_class.new(
+          :analytics,
+          {
+            database: 'mongoid_test',
+            password: 's3cr3t',
+            options: {
+              auto_encryption_options: {
+                kms_providers: { local: { key: 'A' * 96 } }
+              }
+            }
+          }
+        )
+      end
+
+      it 'redacts the password value' do
+        expect(error.message).not_to include('s3cr3t')
+      end
+
+      it 'redacts auto_encryption_options entirely' do
+        expect(error.message).not_to include('kms_providers')
+        expect(error.message).not_to include('A' * 96)
+      end
+    end
   end
 end

data/spec/mongoid/errors/readonly_association_spec.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Mongoid::Errors::ReadonlyAssociation do
+  let(:owner_class) do
+    Class.new do
+      def self.to_s
+        'SomeOwner'
+      end
+    end
+  end
+
+  let(:association) do
+    double(name: :patients, options: { through: :appointments })
+  end
+
+  describe '#message' do
+    it 'names the association' do
+      error = described_class.new(owner_class, association)
+      expect(error.message).to include(':patients')
+    end
+
+    it 'names the owner class' do
+      error = described_class.new(owner_class, association)
+      expect(error.message).to include('SomeOwner')
+    end
+
+    it 'names the intermediate association' do
+      error = described_class.new(owner_class, association)
+      expect(error.message).to include(':appointments')
+    end
+  end
+end