mongoid 9.1.0 → 9.1.1

data/lib/mongoid/config/encryption.rb

@@ -20,18 +20,25 @@ module Mongoid
       #
       # @return [ Hash ] The encryption schema map.
       def encryption_schema_map(default_database, models = ::Mongoid.models)
-        visited = Set.new
         models.each_with_object({}) do |model, map|
-          next if visited.include?(model)
-
-          visited << model
           next if model.embedded?
-          next unless model.encrypted?
+          next unless model.requires_encryption_schema?
 
           database = model.storage_options.fetch(:database) { default_database }
+          # A callable database name cannot be resolved here: the documented
+          # multi-tenant idiom has no correct value while the client is being
+          # built. Interpolating the callable would produce a key that never
+          # matches any namespace, so leave the model out of the map. Writes
+          # are refused later, by PersistenceContext, rather than silently
+          # going out unencrypted.
+          next if database.respond_to?(:call)
+
           key = "#{database}.#{model.collection_name}"
-          props = metadata_for(model).merge(properties_for(model, visited))
-          map[key] = props unless props.empty?
+          props = metadata_for(model).merge(properties_for(model, [ model ]))
+          # The root of a collection schema describes the document, so it is
+          # always an object. Saying so matters when a nested schema carries
+          # encryptMetadata: mongocryptd rejects the schema otherwise.
+          map[key] = { 'bsonType' => 'object' }.merge(props) unless props.empty?
         end
       end
 
@@ -100,11 +107,12 @@ module Mongoid
       # are marked as encrypted.
       #
       # @param [ Mongoid::Document ] model The model to generate the properties for.
-      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      # @param [ Array<Mongoid::Document> ] path The models the walk is already
+      #   inside of, outermost first.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for(model, visited)
-        result = properties_for_fields(model).merge(properties_for_relations(model, visited))
+      def properties_for(model, path)
+        result = properties_for_fields(model).merge(properties_for_relations(model, path))
         if result.empty?
           {}
         else
@@ -141,20 +149,29 @@ module Mongoid
       # are configured to be encrypted.
       #
       # @param [ Mongoid::Document ] model The model to generate the properties for.
-      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      # @param [ Array<Mongoid::Document> ] path The models the walk is already
+      #   inside of, outermost first.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for_relations(model, visited)
+      def properties_for_relations(model, path)
         model.relations.each_with_object({}) do |(name, relation), props|
-          next if visited.include?(relation.relation_class)
+          # relation_class constantizes, and a polymorphic embedded_in has no
+          # class to resolve, so the relation type has to be checked first.
           next unless relation.is_a?(Association::Embedded::EmbedsOne)
-          next unless relation.relation_class.encrypted?
 
-          visited << relation.relation_class
-          metadata_for(
-            relation.relation_class
-          ).merge(
-            properties_for(relation.relation_class, visited)
+          klass = relation.try_relation_class
+          # An association target does not have to be a Mongoid document, and
+          # the class it names does not have to exist.
+          next unless klass.respond_to?(:requires_encryption_schema?)
+          # Stop at a model the walk is already inside of, or a self-embedding
+          # model never terminates. The path covers the current branch only:
+          # a model embedded by two parents, or twice by one parent, has to be
+          # emitted at every place it appears.
+          next if path.include?(klass)
+          next unless klass.requires_encryption_schema?
+
+          metadata_for(klass).merge(
+            properties_for(klass, path + [ klass ])
           ).tap do |properties|
             props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
           end

data/lib/mongoid/config.rb

@@ -130,12 +130,14 @@ module Mongoid
       validate_isolation_level!(level)
     }
 
-    # When this flag is true, it will be possible to change the parent of a
-    # record in a "has_many" association by passing the child record's id in the
-    # nested attributes for another parent record.
+    # When this flag is true, it will be possible to add a record to a
+    # "has_many" or "has_and_belongs_to_many" association by passing that
+    # record's id in the nested attributes for another parent record, even
+    # when the record does not already belong to that association. For a
+    # "has_many" association this moves the record to the new parent.
     #
-    # When this flag is false, attempting to change the parent of a record in a
-    # "has-many" association via nested attributes will raise an error.
+    # When this flag is false, an id in nested attributes is only resolved
+    # within the association itself, and anything else raises an error.
     #
     # The default is `false`. Note that allowing reparenting via nested attributes
     # is a potential security risk, since it could allow a malicious user to move
@@ -294,6 +296,51 @@ module Mongoid
     # See https://jira.mongodb.org/browse/MONGOID-5892 for more details.
     option :serializable_hash_with_legacy_only, default: true
 
+    # When false (default), query operators are restricted when building a
+    # selector, so that user-supplied input reaching the query builder cannot
+    # make MongoDB execute arbitrary JavaScript. Two rules are enforced:
+    #
+    # - An operator at the top level of an expression must appear in
+    #   +Criteria::Queryable::Selectable::ALLOWED_QUERY_OPERATORS+.
+    # - +$where+, +$function+, and +$accumulator+ are rejected at any depth,
+    #   including inside +$expr+ and the logical operators.
+    #
+    # This applies to every query method that accepts an expression, including
+    # +where+, +find_by+, +and+, +or+, +nor+, +not+, +any_of+, and +none_of+.
+    # It also governs the string form of +where+, e.g.
+    # +where("this.name == 'admin'")+, which the server evaluates as +$where+.
+    # Applications relying on that form must set this option to true.
+    #
+    # The APIs that request JavaScript explicitly, +Criteria#for_js+ and
+    # +js_query+, are unaffected: there the developer has asked for it.
+    #
+    # Set to true to restore the unrestricted pass-through behavior.
+    #
+    # Note that this option is deliberately not tied to +load_defaults+: an
+    # application that has opted into older defaults still gets the guard, and
+    # must set this option explicitly to turn it off.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5939,
+    # https://jira.mongodb.org/browse/MONGOID-5993,
+    # https://jira.mongodb.org/browse/MONGOID-5994 for details.
+    option :allow_unsafe_query_operators, default: false
+
+    # The maximum number of seconds that evaluating a single query in memory
+    # may spend executing regular expressions. Queries against an embedded
+    # association are evaluated in the calling thread, so a pattern built from
+    # user input runs locally and can otherwise consume unbounded CPU. The
+    # limit is cumulative over the whole query, since cost grows with the
+    # number of documents and conditions as well as with the pattern.
+    #
+    # Set to nil to remove the limit. On Ruby 3.2 and later the remaining
+    # budget is compiled into the pattern, so the limit counts only the time
+    # spent matching. Earlier Rubies have no per-Regexp timeout, so the query
+    # is bounded with Timeout instead and the limit is wall clock over the
+    # whole in-memory evaluation.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5981 for details.
+    option :in_memory_regexp_time_limit, default: 5.0
+
     # Returns the Config singleton, for use in the configure DSL.
     #
     # @return [ self ] The Config singleton.
@@ -539,6 +586,10 @@ module Mongoid
       end
     end
 
+    # Wraps configuration options that have been deprecated so that assigning
+    # them emits a deprecation warning. OPTIONS is intentionally empty when no
+    # options are currently deprecated; it is populated as options are retired,
+    # at which point this module rewrites their setters to warn.
     module DeprecatedOptions
       OPTIONS = %i[]
 

data/lib/mongoid/contextual/aggregable/memory.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
+require 'mongoid/field_readable'
+
 module Mongoid
   module Contextual
     module Aggregable
       # Contains behavior for aggregating values in memory.
       module Memory
+        include FieldReadable
+
         # Get all the aggregate values for the provided field.
         # Provided for interface consistency with Aggregable::Mongo.
         #
@@ -28,7 +32,7 @@ module Mongoid
         #
         # @return [ Numeric ] The average.
         def avg(field)
-          total = count { |doc| !doc.send(field).nil? }
+          total = count { |doc| !read_field_value(doc, field).nil? }
           return nil unless total > 0
 
           total = total.to_f if total.is_a?(Integer)
@@ -114,7 +118,7 @@ module Mongoid
         def aggregate_by(field, method)
           return nil unless any?
 
-          map { |doc| doc.public_send(field) }.compact.public_send(method)
+          map { |doc| read_field_value(doc, field) }.compact.public_send(method)
         end
       end
     end

data/lib/mongoid/contextual/memory.rb

@@ -2,6 +2,7 @@
 
 require 'mongoid/contextual/aggregable/memory'
 require 'mongoid/association/eager_loadable'
+require 'mongoid/field_readable'
 
 module Mongoid
   module Contextual
@@ -15,6 +16,7 @@ module Mongoid
       include Association::EagerLoadable
       include Queryable
       include Positional
+      include FieldReadable
 
       # @attribute [r] root The root document.
       # @attribute [r] path The atomic path.
@@ -174,10 +176,20 @@ module Mongoid
       # @param [ Criteria ] criteria The criteria.
       def initialize(criteria)
         @criteria, @klass = criteria, criteria.klass
-        @documents = criteria.documents.select do |doc|
-          @root ||= doc._root
-          @collection ||= root.collection
-          doc._matches?(criteria.selector)
+
+        # Resolving the collection can build a Mongo::Client the first time it
+        # runs, so it happens before the budget opens. Where the budget is
+        # enforced with Timeout the exception is asynchronous, and landing in
+        # the middle of that would leave a half-built client behind.
+        if (first = criteria.documents.first)
+          @root = first._root
+          @collection = @root.collection
+        end
+
+        # One regexp budget covers the whole scan, so that the limit bounds the
+        # query rather than each document individually.
+        @documents = Matcher::RegexpBudget.open(criteria.selector) do
+          criteria.documents.select { |doc| doc._matches?(criteria.selector) }
         end
         apply_sorting
         apply_options
@@ -739,10 +751,9 @@ module Mongoid
                          # If this is a localized field, and there are remaining, get the
                          # _translations hash so that we can get the specified translation in
                          # the remaining
-                         document.send("#{segment}_translations") if field&.localized?
+                         document.public_send("#{segment}_translations") if field&.localized?
                        end
-                 meth = klass.aliased_associations[segment] || segment
-                 res.nil? ? document.try(meth) : res
+                 res.nil? ? read_field_value(document, segment) : res
                elsif document.is_a?(Hash)
                  # TODO: Remove the indifferent access when implementing MONGOID-5410.
                  if document.key?(segment.to_s)

data/lib/mongoid/criteria/includable.rb

@@ -44,11 +44,13 @@ module Mongoid
         clone
       end
 
-      # Returns whether to use $lookup aggregation for eager loading.
+      # Returns whether to use $lookup aggregation for eager loading. Only when
+      # eager_load was requested and there is something to load: an empty
+      # inclusion list (e.g. eager_load([])) falls back to the normal path.
       #
       # @return [ true | false ] Whether to use $lookup.
       def use_lookup?
-        !!@use_lookup
+        !!@use_lookup && inclusions.any?
       end
 
       # Get a list of criteria that are to be executed for eager loading.
@@ -96,20 +98,42 @@ module Mongoid
       #   The names of the association(s) to eager load.
       def extract_includes_list(_parent_class, parent, is_eager_load = false, *relations_list)
         relations_list.flatten.each do |relation_object|
-          if relation_object.is_a?(Hash)
-            relation_object.each do |relation, _includes|
-              association = _parent_class.reflect_on_association(relation)
-              raise_eager_error(is_eager_load, _klass, relation) unless association
+          # Normalize a bare association name to a hash with no nested
+          # inclusions, so both forms share one resolution path below.
+          relations = relation_object.is_a?(Hash) ? relation_object : { relation_object => nil }
+
+          relations.each do |relation, nested|
+            associations = resolve_inclusion_associations(_parent_class, relation, is_eager_load)
+            raise_eager_error(is_eager_load, _parent_class, relation) if associations.empty?
+
+            associations.each do |association|
               add_inclusion(association, parent)
-              extract_includes_list(association.klass, association.name, is_eager_load, _includes)
+              extract_includes_list(association.klass, association.name, is_eager_load, nested) if nested
             end
-          else
-            association = _parent_class.reflect_on_association(relation_object)
-            raise_eager_error(is_eager_load, _parent_class, relation_object) unless association
-            add_inclusion(association, parent)
           end
         end
       end
+
+      # Resolve the association(s) matching the given relation name. For the
+      # regular #includes path, only the parent class is consulted. For the
+      # #eager_load ($lookup) path, its subclasses are consulted as well, so
+      # associations defined only on a subclass can also be eager-loaded when
+      # querying through the superclass.
+      #
+      # @param [ Class ] parent_class The class to start the lookup from.
+      # @param [ Symbol | String ] relation The association name.
+      # @param [ Boolean ] is_eager_load Whether to consider subclasses.
+      #
+      # @return [ Array<Mongoid::Association::Relatable> ] Matching associations.
+      def resolve_inclusion_associations(parent_class, relation, is_eager_load)
+        if association = parent_class.reflect_on_association(relation)
+          return [ association ]
+        end
+
+        return [] unless is_eager_load
+
+        parent_class.descendants.filter_map { |sub| sub.reflect_on_association(relation) }
+      end
     end
 
     def raise_eager_error(is_eager_load, klass, relation)

data/lib/mongoid/criteria/queryable/mergeable.rb

@@ -320,6 +320,10 @@ module Mongoid
               end
             end
           end
+          # Every query method that takes a user-supplied expression normalizes
+          # it here, so this is where the operator guard is enforced. See
+          # Selectable#_mongoid_validate_operators! for what it does not cover.
+          _mongoid_validate_operators!(result)
           result
         end
 

data/lib/mongoid/criteria/queryable/selectable.rb

@@ -491,16 +491,16 @@ module Mongoid
           !!negating
         end
 
-        # Negate the arguments, or the next selection if no arguments are given.
-        #
-        # @example Negate the next selection.
-        #   selectable.not.in(field: [ 1, 2 ])
+        # Negate the arguments.
         #
         # @example Add the $not criterion.
-        #   selectable.not(name: /Bob/)
+        #   Person.not(name: /Bob/)
         #
         # @example Execute a $not in a where query.
-        #   selectable.where(:field.not => /Bob/)
+        #   Person.where(:name.not => /Bob/)
+        #
+        # @example Negate a Criteria instance
+        #   Person.not(Person.where(...))
         #
         # @param [ [ Hash | Criteria ]... ] *criteria The key/value pair
         #   matches or Criteria objects to negate.
@@ -508,6 +508,14 @@ module Mongoid
         # @return [ Selectable ] The new selectable.
         def not(*criteria)
           if criteria.empty?
+            # @deprecated
+            Mongoid.deprecation_warning(
+              :not_sans_arguments,
+              'Calling `#not` without arguments is deprecated, and will be ' \
+              'removed in the next major version. Instead, pass the Hash or ' \
+              'Criteria instance to negate.',
+              caller_locations
+            )
             dup.tap { |query| query.negating = !query.negating }
           else
             criteria.compact.inject(clone) do |c, new_s|
@@ -768,6 +776,12 @@ module Mongoid
             # only ever specify one criterion to #where.
             @criterion = criterion
             if criterion.is_a?(String)
+              unless Mongoid.allow_unsafe_query_operators?
+                raise Errors::InvalidQuery,
+                      "String criteria are not allowed because they compile to the '$where' operator, " \
+                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
               query.js_query(criterion)
             else
               query.expr_query(criterion)
@@ -775,6 +789,19 @@ module Mongoid
           end
         end
 
+        # Operators permitted at the top level of a query expression without
+        # opt-in. Excludes $where (JS execution) and other operators not needed
+        # for ordinary application queries.
+        ALLOWED_QUERY_OPERATORS = %w[
+          $and $or $nor $not $text $comment $expr $jsonSchema $alwaysFalse $alwaysTrue
+        ].freeze
+
+        # Operators that execute server-side JavaScript. These are rejected at
+        # any depth, not just at the top level: the allowlist above permits
+        # $expr and the logical operators, and their values are arbitrary
+        # nested expressions that can carry $function or $where.
+        JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
         # Adds the specified expression to the query.
         #
         # Criterion must be a hash in one of the following forms:
@@ -798,12 +825,13 @@ module Mongoid
             raise Errors::InvalidQuery, "Expression must be a Hash: #{Errors::InvalidQuery.truncate_expr(criterion)}"
           end
 
+          # The operator guard is applied by _mongoid_expand_keys, which every
+          # query method that accepts a user-supplied expression passes through.
           normalized = _mongoid_expand_keys(criterion)
           clone.tap do |query|
             normalized.each do |field, value|
               field_s = field.to_s
               if field_s.start_with?('$')
-                # Query expression-level operator, like $and or $where
                 query.add_operator_expression(field_s, value)
               else
                 query.add_field_expression(field, value)
@@ -837,6 +865,94 @@ module Mongoid
 
         private
 
+        # Enforces the operator rules governed by the
+        # +allow_unsafe_query_operators+ configuration option against a
+        # normalized query expression.
+        #
+        # Two rules apply, and both are skipped when the option is true:
+        #
+        # - An operator at the top level of the expression must appear in
+        #   ALLOWED_QUERY_OPERATORS.
+        # - An operator in JAVASCRIPT_QUERY_OPERATORS is rejected at any depth.
+        #
+        # This is called from #_mongoid_expand_keys rather than from the
+        # individual query methods, because that is the one point every query
+        # method taking a user-supplied expression passes through on its way to
+        # the selector.
+        #
+        # It deliberately does not cover the APIs that ask for JavaScript
+        # outright, such as #js_query and Criteria#for_js: there the developer
+        # has chosen server-side JavaScript, so there is nothing to guard
+        # against. The same goes for the low-level Storable methods
+        # (#add_field_expression, #add_operator_expression), which write to the
+        # selector directly.
+        #
+        # @param [ Hash ] expr A normalized query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a disallowed operator is present.
+        #
+        # @api private
+        def _mongoid_validate_operators!(expr)
+          return if Mongoid.allow_unsafe_query_operators?
+
+          expr.each_key do |field|
+            field_s = field.to_s
+            next unless field_s.start_with?('$')
+            next if ALLOWED_QUERY_OPERATORS.include?(field_s)
+
+            raise Errors::InvalidQuery,
+                  "Operator '#{field_s}' is not allowed in a query expression. " \
+                  'Set Mongoid.allow_unsafe_query_operators = true to permit all operators.'
+          end
+
+          _mongoid_validate_no_javascript!(expr)
+        end
+
+        # Walks a query expression looking for operators that execute
+        # server-side JavaScript, descending through both hashes and arrays so
+        # that nested forms such as {'$expr' => {'$function' => ...}} and
+        # {'$or' => [ {'$where' => ...} ]} are caught.
+        #
+        # The walk does not distinguish operator position from value position,
+        # so it also rejects queries where a JavaScript operator name appears as
+        # data rather than as an operator. Server 5.0+ permits $-prefixed field
+        # names in stored documents, which makes this reachable:
+        #
+        #   Doc.where(payload: { '$eq' => { '$function' => 'abc' } })
+        #
+        # Here the $eq marks its argument as a literal value to compare, so the
+        # server never evaluates it, but the guard raises anyway. The only
+        # workaround today is the global allow_unsafe_query_operators flag.
+        #
+        # TODO: discuss whether to track operator position (skipping the subtree
+        # under $eq, $ne, $in, $nin, and $elemMatch values) in a future
+        # iteration. It removes the false positive but adds exactly the kind of
+        # state that a real bypass could hide in, so it was left out for now.
+        #
+        # @param [ Object ] object A fragment of a query expression.
+        #
+        # @raise [ Errors::InvalidQuery ] If a JavaScript operator is present.
+        #
+        # @api private
+        def _mongoid_validate_no_javascript!(object)
+          case object
+          when Hash
+            object.each do |key, value|
+              key_s = key.to_s
+              if JAVASCRIPT_QUERY_OPERATORS.include?(key_s)
+                raise Errors::InvalidQuery,
+                      "Operator '#{key_s}' executes server-side JavaScript and is not allowed " \
+                      'anywhere in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
+                      'to permit all operators.'
+              end
+
+              _mongoid_validate_no_javascript!(value)
+            end
+          when Array
+            object.each { |value| _mongoid_validate_no_javascript!(value) }
+          end
+        end
+
         # Force the values of the criterion to be evolved.
         #
         # @api private

data/lib/mongoid/deprecable.rb

@@ -7,6 +7,29 @@ module Mongoid
   #
   # @api private
   module Deprecable
+    # A Mongoid::Deprecation instance to use for reporting deprecations
+    def deprecator
+      @deprecator ||= Mongoid::Deprecation.new
+    end
+
+    # Resets all deprecation warnings. For use in tests.
+    def reset_deprecation_warnings!
+      DEPRECATION_WARNING_MUTEX.synchronize { @deprecation_warnings = {} }
+    end
+
+    # Emits a warning using the current deprecator. If the given warning (as
+    # identified by `id`) has already been issued previously, this is a no-op.
+    #
+    # @param [ Symbol ] id The unique identifier for this warning.
+    # @param [ String ] warning The warning message to emit.
+    # @param [ Array<Thread::Backtrace::Location> | nil ] callstack The backtrace at the call site.
+    def deprecation_warning(id, warning, callstack = nil)
+      site = callstack&.first
+      deprecation_warning_guard(id, site ? "#{site.path}:#{site.lineno}" : nil) do
+        deprecator.warn(warning, callstack)
+      end
+    end
+
     # Declares method(s) as deprecated.
     #
     # @example Deprecate a method.
@@ -25,8 +48,28 @@ module Mongoid
     # @param [ [ Symbol | Hash<Symbol, [ Symbol | String ]> ]... ] *method_descriptors
     #   The methods to deprecate, with optional replacement instructions.
     def deprecate(target_module, *method_descriptors)
-      @_deprecator ||= Mongoid::Deprecation.new
-      @_deprecator.deprecate_methods(target_module, *method_descriptors)
+      deprecator.deprecate_methods(target_module, *method_descriptors)
+    end
+
+    private
+
+    # The Mutex instance used to guard the deprecation warning flags.
+    DEPRECATION_WARNING_MUTEX = Mutex.new
+
+    # Wraps access to the warnings Hash in a synchronize block. If the given
+    # id+callsite has not been warned already, the method will yield to a block and then
+    # flag the id. Otherwise, it returns immediately.
+    def deprecation_warning_guard(id, callsite)
+      DEPRECATION_WARNING_MUTEX.synchronize do
+        @deprecation_warnings ||= {}
+
+        key = "#{id}:#{callsite}"
+        return if @deprecation_warnings.key?(key)
+
+        yield
+
+        @deprecation_warnings[key] = true
+      end
     end
   end
 end

data/lib/mongoid/encryptable.rb

@@ -36,6 +36,52 @@ module Mongoid
         !encrypt_metadata.empty? || fields.any? { |_, field| field.is_a?(Mongoid::Fields::Encrypted) }
       end
 
+      # Whether an encryption schema has to be generated for this model.
+      #
+      # True when the model declares encryption itself, and also when any model
+      # reachable through its embeds_one relations does. A model in the second
+      # group has no encrypted field of its own, but its collection still needs
+      # a schema, otherwise the embedded fields are written in plaintext.
+      #
+      # The answer is memoized, since this runs on the persistence path.
+      # Declaring encryption on a model after it has already been persisted is
+      # not supported.
+      #
+      # @return [ true | false ] Whether the model needs an encryption schema.
+      #
+      # @api private
+      def requires_encryption_schema?
+        return @requires_encryption_schema if defined?(@requires_encryption_schema)
+
+        @requires_encryption_schema = encrypted? || embeds_encrypted?([ self ])
+      end
+
+      # Whether any model reachable through this model's embeds_one relations
+      # declares encryption.
+      #
+      # embeds_many is not considered: libmongocrypt cannot express per-field
+      # encryption under array items, so those fields are never mapped.
+      #
+      # @param [ Array<Class> ] path The models the walk is already inside of.
+      #   A model embedding itself terminates here.
+      #
+      # @return [ true | false ] Whether an embedded model is encrypted.
+      #
+      # @api private
+      def embeds_encrypted?(path)
+        relations.each_value.any? do |relation|
+          next false unless relation.is_a?(Association::Embedded::EmbedsOne)
+
+          klass = relation.try_relation_class
+          # An association target does not have to be a Mongoid document, and
+          # the class it names does not have to exist.
+          next false unless klass.respond_to?(:encrypted?)
+          next false if path.include?(klass)
+
+          klass.encrypted? || klass.embeds_encrypted?(path + [ klass ])
+        end
+      end
+
       # Override the key_id for the model.
       #
       # This method is solely for testing purposes and should not be used in

data/lib/mongoid/errors/config_redactor.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # Redacts credentials from a client configuration hash before it is
+    # interpolated into an exception message.
+    module ConfigRedactor
+      extend self
+
+      REDACTED = '[REDACTED]'
+
+      # Top-level keys whose values should be replaced wholesale.
+      SENSITIVE_KEYS = %w[password auto_encryption_options].freeze
+
+      # Match the userinfo portion of a MongoDB connection string.
+      URI_USERINFO = %r{\A(mongodb(?:\+srv)?://)[^@/]+@}.freeze
+
+      # Return a copy of the given config hash with sensitive values redacted.
+      # Recurses into nested hashes so that, e.g., `:options =>
+      # { :auto_encryption_options => ... }` is also covered. Non-hash inputs
+      # are returned unchanged.
+      def redact(config)
+        return config unless config.is_a?(Hash)
+
+        config.each_with_object({}) do |(key, value), result|
+          result[key] = redact_value(key, value)
+        end
+      end
+
+      def redact_value(key, value)
+        if SENSITIVE_KEYS.include?(key.to_s)
+          REDACTED
+        elsif key.to_s == 'uri' && value.is_a?(String)
+          value.sub(URI_USERINFO, "\\1#{REDACTED}@")
+        elsif value.is_a?(Hash)
+          redact(value)
+        else
+          value
+        end
+      end
+    end
+  end
+end