The GitHub Actions job "Code Style" on 
grails-core.git/fix/mongodb-map-criterion-values has succeeded.
Run started by GitHub user matrei (triggered by matrei).

Head commit for run:
d1f4dd85970b16dfd6088b5ae3aa3aa308f57d71 / Mattias Reichel 
<[email protected]>
fix: validate Map criterion values in GORM for MongoDB queries

A Map passed as a criterion value was placed into the BSON query document
unchanged. MongoDB interprets a value document whose keys start with '$' as
an operator expression rather than as a value, so such a map changed the
meaning of the query instead of being compared as a value.

Validation now runs once at the dispatch choke point. A new
BsonQuery.validateCriterionValues is called for every criterion at the top
of both populateBsonQuery loops and of MongoQuery.populateMongoQuery, before
the custom type branch, and recurses through junctions. It validates the
value of every PropertyCriterion, both Between bounds and every In element,
so enum and other custom typed properties, negated criteria and any handler
added later are covered. Geospatial and subquery criteria carry shape
documents or nested queries by design and are registered as exempt through
a static set that MongoQuery extends the way it registers handlers.

A Map value is rejected with InvalidDataAccessResourceUsageException when a
key at any depth starts with '$'. Keys are compared through String.valueOf,
the walk descends into nested maps, collections and arrays, and it is capped
at MongoDB's own 100 level nesting limit so a self-referential value is
reported as invalid rather than overflowing the stack. A Map without such
keys is sent as a literal subdocument comparison on any property, so exact
matches on Map properties, dotted paths, array elements and schemaless
attributes are unchanged. The exception message names the entity and
property only. The native find(Bson) and collection APIs are untouched and
remain the place for deliberate operator queries.

Tests: BsonQuerySpec (no database) is data-driven over every affected
criterion including idEq, negated and nested criteria, a bson Document
value, '$' keys at every depth and as a GString key, self-referential map,
list and array values, and '$'-free maps passing through as literals. A new
live MapCriterionValueSpec exercises the public APIs end to end, including
every query form on an enum property, and pins the cases that must keep
working; its query forms are checked in one feature because the 7.0.x TCK
manager recreates every registered collection per feature. The behaviour
is described in the MongoDB querying guide and the 7.0 upgrade notes.

Report URL: https://github.com/apache/grails-core/actions/runs/35614478825

With regards,
GitHub Actions via GitBox

Reply via email to