Skip to content

Fix invalid BSON regex flags in DatabasePresenceVerifier::getCount() - #3563

Merged
GromNaN merged 2 commits into
mongodb:5.9from
zigzagdev:fix/presence-verifier-regex-flags
Aug 5, 2026
Merged

Fix invalid BSON regex flags in DatabasePresenceVerifier::getCount()#3563
GromNaN merged 2 commits into
mongodb:5.9from
zigzagdev:fix/presence-verifier-regex-flags

Conversation

@zigzagdev

Copy link
Copy Markdown
Contributor

Summary

Description

DatabasePresenceVerifier::getCount() was passing '/i' as the flags argument to MongoDB\BSON\Regex, instead of the plain PCRE flag character 'i'.
Regex flags must only contain flag characters (i, m, x, s, ...), not a delimiter-style string.
The sibling method getMultiCount() already used the correct 'i'.

This PR has no observable effect against MongoDB's current PHP driver/server: the BSON encoder silently strips invalid flag characters before a query ever reaches the server (verified by inspecting the actual command sent via CommandSubscriber).
Still, constructing an invalid Regex value is incorrect and worth fixing for correctness / forward-compatibility.

Test Plans

Added testGetCountBuildsRegexWithValidFlags() to ValidationTest.php.
Since the invalid flags can't be observed end-to-end (see above), the test asserts against the raw Regex object passed to where(), using a lightweight stub in place of the query builder/connection.

Checklist

  • Add tests and ensure they pass

Test Results

vendor/bin/phpunit tests/ValidationTest.php --testdox
PHPUnit 10.5.47 by Sebastian Bergmann and contributors.

Runtime:       PHP 8.2.32
Configuration: /var/www/laravel-mongodb/phpunit.xml

...                                                                 3 / 3 (100%)

Time: 00:00.950, Memory: 26.00 MB

Validation (MongoDB\Laravel\Tests\Validation)
 ✔ Unique
 ✔ Exists
 ✔ Get count builds regex with valid flags

OK (3 tests, 19 assertions)

@zigzagdev
zigzagdev requested a review from a team as a code owner August 4, 2026 23:33
@zigzagdev
zigzagdev requested a review from GromNaN August 4, 2026 23:33
@GromNaN GromNaN added the bug label Aug 5, 2026
@GromNaN
GromNaN changed the base branch from 5.x to 5.9 August 5, 2026 12:51

@GromNaN GromNaN left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix is correct. MongoDB\BSON\Regex expects flag characters only (i, m, x, ...) without PCRE delimiters, so replacing '/i' with 'i' is the right change, consistent with what getMultiCount() already does.

Tests: The new testGetCountBuildsRegexWithValidFlags test correctly validates the flags using a lightweight stub, and the assertion would fail with the old code (getFlags() would return '/i'). The existing testUnique and testExists tests cover the end-to-end behavior.

Security review: No issues. preg_quote() properly escapes user input, anchors ^/$ prevent partial matches, and the regex has no quantifiers that could cause ReDoS.

Performance: The invalid / flag was stripped by the BSON encoder before reaching the server (as noted in the PR description), so no query behavior change is expected.

Thanks for spotting this inconsistency and for the thorough PR description explaining the observable impact!

MongoDB\BSON\Regex expects PCRE flag characters only (e.g. "i"), not a
delimiter-style string like "/i". getMultiCount() already passed the
flags correctly; getCount() did not.
Regression test for the flags fix in the previous commit. Asserts
against the raw Regex object passed to where(), since MongoDB's BSON
encoder silently strips invalid flag characters before a query ever
reaches the server, making the bug unobservable end-to-end.
@GromNaN
GromNaN force-pushed the fix/presence-verifier-regex-flags branch from 10c395b to ea858bc Compare August 5, 2026 13:02
@GromNaN GromNaN changed the title fix: use valid BSON regex flags in DatabasePresenceVerifier Fix invalid BSON regex flags in DatabasePresenceVerifier::getCount() Aug 5, 2026
@GromNaN
GromNaN enabled auto-merge (squash) August 5, 2026 13:04
@GromNaN
GromNaN merged commit 8a5fa18 into mongodb:5.9 Aug 5, 2026
30 checks passed
@zigzagdev
zigzagdev deleted the fix/presence-verifier-regex-flags branch August 6, 2026 02:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants