mongoid 9.1.0 → 9.1.1

data/spec/integration/matcher_regexp_timeout_spec.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require 'benchmark'
+require 'spec_helper'
+
+describe 'in-memory regexp time limit' do
+  # See the comment in spec/mongoid/matcher/regexp_budget_spec.rb: costly to
+  # match but bounded on every supported Ruby. A pattern relying on nested
+  # quantifiers would hang before Ruby 3.2, where the examples that have no
+  # interrupt available could not stop it.
+  let(:slow_pattern) { "(?:#{(1..300).map { |i| "a#{i}" }.join('|')})Z" }
+  let(:slow_street) { 'a' * 5_000 }
+
+  let(:person) do
+    # Address derives its _id from the street, so the streets have to differ or
+    # the embedded association collapses to a single document.
+    Person.new(addresses: Array.new(30) { |i| Address.new(street: "#{slow_street}#{i}") })
+  end
+
+  let(:one_address) { Person.new(addresses: [ Address.new(street: slow_street) ]) }
+
+  # What one match of the fixture costs on the machine running the suite. It
+  # varies by more than an order of magnitude between implementations - around
+  # 6ms on MRI, 110ms on JRuby - so the examples below calibrate against a
+  # measurement instead of hard-coding a threshold that only holds on one.
+  let(:single_match_cost) do
+    regexp = Regexp.new(slow_pattern)
+    3.times { slow_street =~ regexp }
+    Benchmark.realtime { slow_street =~ regexp }
+  end
+
+  # Comfortably more than one match, comfortably less than twenty. The examples
+  # only need the ordering to hold, so the margin either side is wide.
+  let(:calibrated_limit) { single_match_cost * 5 }
+
+  context 'when the limit is disabled' do
+    config_override :in_memory_regexp_time_limit, nil
+
+    it 'evaluates the query without a bound' do
+      expect(person.addresses.where(street: { '$regex' => slow_pattern }).to_a).to eq([])
+    end
+  end
+
+  context 'when a limit is configured' do
+    config_override :in_memory_regexp_time_limit, nil
+
+    before { Mongoid::Config.in_memory_regexp_time_limit = calibrated_limit }
+
+    it 'leaves ordinary queries alone' do
+      person = Person.new(addresses: [ Address.new(street: 'Clarkson') ])
+      expect(person.addresses.where(street: { '$regex' => '\AClark' }).to_a.size).to eq(1)
+    end
+
+    it 'does not raise for a single document' do
+      # The counterpart to the example below, and what makes it meaningful: one
+      # document stays under the limit, so a scan that raises can only have got
+      # there by accumulating cost across documents.
+      expect do
+        one_address.addresses.where(street: { '$regex' => slow_pattern }).to_a
+      end.not_to raise_error
+    end
+
+    it 'raises for a scan over many documents under that same limit' do
+      expect do
+        person.addresses.where(street: { '$regex' => slow_pattern }).to_a
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+
+    it 'raises when $in multiplies the cost within a single document' do
+      conditions = Array.new(20) { BSON::Regexp::Raw.new(slow_pattern) }
+
+      expect do
+        one_address.addresses.where(street: { '$in' => conditions }).to_a
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+
+    it 'raises through the public _matches? API' do
+      # 20 conditions rather than one, because a single match is deliberately
+      # kept well under the limit by the calibration above.
+      conditions = Array.new(20) { BSON::Regexp::Raw.new(slow_pattern) }
+
+      expect do
+        person.addresses.first._matches?('street' => { '$in' => conditions })
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+  end
+
+  context 'when the pattern is pathological' do
+    config_override :in_memory_regexp_time_limit, 0.2
+
+    # The ticket's Case 1, verbatim. It backtracks exponentially and is the
+    # reason the guard exists, so every entry point that evaluates a selector
+    # in memory has to bound it. The subject is kept short enough that the
+    # match still finishes on its own in a few seconds, so an entry point that
+    # fails to bound it shows up as a failing example rather than a hung run.
+    let(:evil_pattern) { '^(a+)+\1?$' }
+    let(:evil_subject) { "#{'a' * 28}X" }
+
+    it 'bounds a scan over an embedded association' do
+      person = Person.new(addresses: [ Address.new(street: evil_subject) ])
+
+      expect do
+        person.addresses.where(street: { '$regex' => evil_pattern }).to_a
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+
+    it 'bounds the public _matches? API' do
+      expect do
+        Address.new(street: evil_subject)._matches?('street' => { '$regex' => evil_pattern })
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+
+    it 'bounds removal from a referenced association' do
+      owner = Person.create!
+      owner.posts.create!(title: evil_subject)
+
+      expect do
+        owner.posts.delete_all(title: { '$regex' => evil_pattern })
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+
+    it 'deletes nothing when removal is bounded' do
+      # The scan runs before the delete, so the error means what a caller would
+      # take it to mean: the documents are still there.
+      owner = Person.create!
+      owner.posts.create!(title: evil_subject)
+
+      expect do
+        owner.posts.delete_all(title: { '$regex' => evil_pattern })
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+
+      expect(Post.count).to eq(1)
+      expect(owner.reload.posts.size).to eq(1)
+    end
+  end
+
+  context 'when the association being removed from has not been loaded' do
+    config_override :in_memory_regexp_time_limit, 0.2
+
+    let!(:owner) do
+      person = Person.create!
+      person.posts.create!(title: 'Testing')
+      Person.find(person._id)
+    end
+
+    # The query that loads the association, which removal has to run before it
+    # has anything to match against.
+    let(:load_query) { owner.posts._target._unloaded }
+
+    # A stall standing in for a slow network. It is longer than the limit, and
+    # none of it is time spent on regular expressions.
+    before do
+      allow(load_query).to receive(:each).and_wrap_original do |original, *args, &block|
+        sleep(0.3)
+        original.call(*args, &block)
+      end
+    end
+
+    it 'does not load it, so no query can be counted against the limit' do
+      # On the Timeout path a deadline covering the fetch failed a slow query
+      # with an error about regular expressions, and the asynchronous exception
+      # could land inside the driver's socket read, leaving the connection with
+      # unconsumed bytes. Nothing is fetched now: the scan sees only what the
+      # association already holds.
+      stub_const('Mongoid::Matcher::RegexpBudget::PER_REGEXP_TIMEOUT', false)
+
+      expect do
+        owner.posts.delete_all(title: { '$regex' => '\Azzz' })
+      end.not_to raise_error
+
+      expect(load_query).not_to have_received(:each)
+    end
+
+    it 'runs no pattern against documents it never loaded' do
+      # The counterpart to the referenced-association examples below, where the
+      # documents are in memory and the pattern is run against every one of
+      # them. Here there is nothing to run it against, and the server applies
+      # the same selector for the delete, so nothing is missed by not looking.
+      expect(Mongoid::Matcher::RegexpBudget).not_to receive(:match?)
+
+      owner.posts.delete_all(title: { '$regex' => '\Azzz' })
+    end
+
+    it 'still removes the documents that match' do
+      expect(owner.posts.delete_all(title: { '$regex' => '\ATest' })).to eq(1)
+      expect(Post.count).to eq(0)
+      expect(owner.posts.size).to eq(0)
+    end
+  end
+
+  context 'when removing documents from a referenced association' do
+    config_override :in_memory_regexp_time_limit, nil
+
+    let!(:owner) { Person.create! }
+
+    before do
+      30.times { owner.posts.create!(title: slow_street) }
+      Mongoid::Config.in_memory_regexp_time_limit = calibrated_limit
+    end
+
+    it 'raises rather than scanning every loaded document' do
+      expect do
+        owner.posts.delete_all(title: { '$regex' => slow_pattern })
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+    end
+
+    it 'leaves the documents in place' do
+      expect do
+        owner.posts.delete_all(title: { '$regex' => slow_pattern })
+      end.to raise_error(Mongoid::Errors::InMemoryRegexpTimeout)
+
+      expect(Post.count).to eq(30)
+    end
+  end
+end

data/spec/integration/query_operator_guard_spec.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'query operator injection guard' do
+  let(:js) { 'this.name == "admin"' }
+
+  let(:nested_function) do
+    { '$expr' => { '$function' => { 'body' => 'function() { return true; }', 'args' => [], 'lang' => 'js' } } }
+  end
+
+  let(:band) { Band.create!(name: 'Depeche Mode') }
+
+  context 'with default configuration' do
+    it 'rejects unsafe operators without any opt-out' do
+      expect(Mongoid.allow_unsafe_query_operators).to be false
+    end
+
+    context 'when querying with where' do
+      it 'rejects a top-level $where' do
+        expect { Band.where('$where' => js).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'rejects a $function nested in $expr' do
+        expect { Band.where(nested_function).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'permits an ordinary query' do
+        expect(Band.where(name: band.name).first).to eq(band)
+      end
+    end
+
+    context 'when querying with find_by' do
+      it 'rejects a top-level $where' do
+        expect { Band.find_by('$where' => js) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'rejects a $function nested in $expr' do
+        expect { Band.find_by(nested_function) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying with find_or_create_by' do
+      it 'rejects a top-level $where' do
+        expect { Band.find_or_create_by('$where' => js) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying with find_or_initialize_by' do
+      it 'rejects a top-level $where' do
+        expect { Band.find_or_initialize_by('$where' => js) }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying an association with find_or_create_by' do
+      it 'rejects a top-level $where' do
+        expect do
+          band.records.find_or_create_by('$where' => js)
+        end.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+
+    context 'when querying with a logical operator' do
+      it 'rejects a $where smuggled through or' do
+        expect { Band.or('$where' => js).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      it 'rejects a $where smuggled through any_of' do
+        expect { Band.any_of('$where' => js).first }.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+    end
+  end
+
+  context 'when allow_unsafe_query_operators is true' do
+    config_override :allow_unsafe_query_operators, true
+
+    it 'permits a top-level $where' do
+      expect(Band.where('$where' => "this.name == '#{band.name}'").first).to eq(band)
+    end
+
+    it 'permits a $function nested in $expr' do
+      expect { Band.where(nested_function).first }.not_to raise_error
+    end
+
+    it 'permits a $where smuggled through or' do
+      expect { Band.or('$where' => js).first }.not_to raise_error
+    end
+  end
+end

data/spec/mongoid/association/eager_loadable_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Mongoid::Association::EagerLoadable do
+  context 'with through associations' do
+    before(:all) do
+      Object.const_set(:ELPhysician, Class.new do
+        include Mongoid::Document
+
+        store_in collection: 'el_physicians'
+        has_many :el_appointments, class_name: 'ELAppointment', inverse_of: :el_physician
+        has_many :el_patients, through: :el_appointments,
+                               class_name: 'ELPatient', source: :el_patient
+      end)
+      Object.const_set(:ELAppointment, Class.new do
+        include Mongoid::Document
+
+        store_in collection: 'el_appointments'
+        belongs_to :el_physician, class_name: 'ELPhysician'
+        belongs_to :el_patient, class_name: 'ELPatient'
+      end)
+      Object.const_set(:ELPatient, Class.new do
+        include Mongoid::Document
+
+        store_in collection: 'el_patients'
+      end)
+    end
+
+    after(:all) do
+      %w[ELPhysician ELAppointment ELPatient].each { |c| Object.send(:remove_const, c) }
+    end
+
+    before { [ ELPhysician, ELAppointment, ELPatient ].each(&:delete_all) }
+
+    it 'logs a warning and falls back to preload when eager_load is used with a through association' do
+      physician = ELPhysician.create!
+      patient   = ELPatient.create!
+      ELAppointment.create!(el_physician: physician, el_patient: patient)
+
+      expect(Mongoid.logger).to receive(:warn).with(a_string_including('through'))
+
+      docs = ELPhysician.eager_load(:el_patients).to_a
+      expect(docs.first.el_patients.to_a).to include(patient)
+    end
+  end
+end

data/spec/mongoid/association/eager_spec.rb

@@ -679,9 +679,9 @@ describe Mongoid::Association::EagerLoadable do
         expect(docs.first.posts).to eq([ post ])
       end
 
-      it 'mentions the offending association and client in the warning' do
+      it 'mentions the offending association, client, and database in the warning' do
         expect(Mongoid.logger).to receive(:warn).with(
-          /posts \(other_cluster\)/
+          /posts \(client: other_cluster, database: /
         )
         context.eager_load_with_lookup
       end

data/spec/mongoid/association/embedded/embeds_many/proxy_spec.rb

@@ -4524,6 +4524,39 @@ describe Mongoid::Association::Embedded::EmbedsMany::Proxy do
         expect(reloaded_band).not_to have_key(:labels)
       end
     end
+
+    context 'when set via raw attribute write in a before_save callback' do
+      after { Band.reset_callbacks(:save) }
+
+      let(:reloaded_band) { Band.collection.find(_id: band._id).first }
+
+      context 'on a new record' do
+        before { Band.before_save { self[:labels] ||= [] } }
+
+        let(:band) { Band.create! }
+
+        it 'persists the empty list' do
+          expect(reloaded_band).to have_key(:labels)
+          expect(reloaded_band[:labels]).to eq []
+        end
+      end
+
+      context 'on an existing record' do
+        # Reload the band from MongoDB so the labels proxy has not been
+        # initialized, which is the scenario that triggers the bug.
+        let(:band) { Band.find(Band.create!._id) }
+
+        before do
+          Band.before_save { self[:labels] ||= [] }
+          band.save!
+        end
+
+        it 'persists the empty list' do
+          expect(reloaded_band).to have_key(:labels)
+          expect(reloaded_band[:labels]).to eq []
+        end
+      end
+    end
   end
 
   context 'when using assign_attributes with an already populated array' do