MONGOID-5939 Guard against NoSQL operator injection in where/find_by

[comandeo-mongo]

What

Adds a guard in expr_query that rejects top-level $ operators not in an explicit allowlist when allow_unsafe_query_operators is set to false. The default is true (existing behavior preserved — no BC break).

To opt into the strict mode:

Mongoid.configure do |config|
  config.allow_unsafe_query_operators = false
end

With strict mode on, operators like $where and $function raise Errors::InvalidQuery. Allowed operators: $and, $or, $nor, $not, $text, $comment, $expr, $jsonSchema, $alwaysFalse, $alwaysTrue.

Why

When user-supplied params are passed directly to where/find_by (e.g. via to_unsafe_h), an attacker can inject top-level operators like $where to execute arbitrary JavaScript on the MongoDB server.

Files changed

• lib/mongoid/config.rb — new allow_unsafe_query_operators option (default: true)
• lib/mongoid/criteria/queryable/selectable.rb — ALLOWED_QUERY_OPERATORS constant and guard in expr_query
• spec/mongoid/criteria/queryable/selectable_where_spec.rb — 14 new examples covering the guard
• Gemfile — add ostruct for Ruby 4.0+ compatibility

Test plan

• 14 new examples in selectable_where_spec.rb covering blocked operators, allowlisted operators, and opt-in strict mode
• All 1681 queryable specs pass with no regressions
• RuboCop reports no offenses

Jira: https://jira.mongodb.org/browse/MONGOID-5939

[jamis]

There are several rubocop complaints from the new code, but otherwise it looks good 👍

[Copilot]

Pull request overview

This PR adds an opt-in security hardening mode to Mongoid’s query builder to mitigate NoSQL operator injection via where/find_by by rejecting non-allowlisted top-level $ operators when configured to do so.

Changes:

• Introduces Mongoid.allow_unsafe_query_operators config option (default true) to preserve existing behavior unless explicitly disabled.
• Adds a top-level operator allowlist and enforcement in Selectable#expr_query for Hash-based criteria.
• Adds RSpec coverage for both default (permissive) and strict (allowlist) modes, including allowlisted operators.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lib/mongoid/config.rb	Adds allow_unsafe_query_operators configuration option and documentation.
lib/mongoid/criteria/queryable/selectable.rb	Implements allowlist constant and guard in expr_query for top-level $ operators.
spec/mongoid/criteria/queryable/selectable_where_spec.rb	Adds examples verifying permissive vs strict behavior and allowlisted operators.
spec/mongoid/criteria/queryable/selectable_spec.rb	Whitespace-only change.
Gemfile	Adds ostruct dependency conditionally for Ruby 4.0+.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.