Skip to content

Tests for the Mongo semantics the heuristics calculator does not reproduce - #1761

Closed
LautaroPetaccio wants to merge 1 commit into
WebFuzzing:fix_all_semanticsfrom
LautaroPetaccio:tests/mongo-heuristics-semantics-gaps
Closed

LautaroPetaccio wants to merge 1 commit into
WebFuzzing:fix_all_semanticsfrom
LautaroPetaccio:tests/mongo-heuristics-semantics-gaps

Conversation

@LautaroPetaccio

Copy link
Copy Markdown
Collaborator

Follow-up to the review on #1750, turning each comment there into a test. Based on fix_all_semantics rather than master, since most of these are about code that only exists on that branch.

Sixteen tests. Thirteen fail and carry @Disabled with the reason, three pass and are there as guards. Every expected value came from a MongoDB 7.0.41 server answering the same query against the same document, so the assertions say what the database does rather than what the documentation implies.

Queries that make the calculator throw

MongoHandler catches nothing around computeDistanceDocuments, so the exception costs the action its whole ExtraHeuristicsDto, the SQL heuristics computed before it included.

Query mongo 7.0.41 calculator
{a:{$regex:"x"}} vs {a:[1,2,3]} 0 documents IllegalArgumentException
{a:{$bitsAllSet: BinData(0,"Ag==")}} vs {a:2} 1 document NullPointerException
{a:{$not:/x/}} vs {a:"aa"} 1 document NullPointerException
{a:{$mod:[0,0]}} rejects the query ArithmeticException
{a:{$size:-1}} rejects the query NullPointerException

The first one is a regression: the code this PR replaces returned C_FALSE for it.

Queries that are answered, but not the way the database answers them

Query mongo 7.0.41 calculator
{a:{$bitsAllSet:[-1]}} vs {a: Long.MIN_VALUE} rejects the query match
{a:{$bitsAllSet: 3.9}} vs {a:3} rejects the query match
{a:{$bitsAllSet: -1}} vs {a:-1} rejects the query match
{a:{$all:[1,1]}} vs {a:1} 1 document no match
{a:{$all:[null,null]}} vs {b:1} 1 document no match
{a:{$eq:{$comment:"note",x:1}}} vs the same document 1 document no match
{a:{$in:[/x/]}} vs {a:"xy"} 1 document no match

The three bitmask rows share a cause: nothing validates the mask itself, while the field side of the same comparison is validated by getIntegralLongValue.

One that is not about MongoDB semantics

computeDistanceDocuments walks its Iterable three times, and MongoHandler peeks at it once before that. What is passed in today is a FindIterable, which replays, so this is four find round trips per action rather than a wrong answer. The test uses an Iterable that cannot be replayed, which the signature currently accepts, and that one is scored as if the collection were empty while still reporting the documents counted on the first pass.

The three that pass

One per group of defects, covering the neighbouring case that is already handled: a byte[] bitmask, $comment at the top level, and $all holding a single null. They are there so a fix can be told apart from a regression in the path beside it.

Running them

Green as they stand, 16 run and 13 skipped. Dropping the @Disabled annotations turns those 13 into failures. The whole mongo package is 351 tests, 0 failures, 18 skipped with this branch applied.

🤖 Generated with Claude Code

…oduce

Thirteen queries where the calculator disagrees with the database, and three
neighbouring cases that it already answers correctly, kept as guards so that a
fix can be told apart from a regression in the path next to it.

Every expected value was taken from a MongoDB 7.0.41 server answering the same
query against the same document, so the assertions state what the database does
rather than a reading of the documentation.

Six of the queries make the calculator throw, and MongoHandler catches nothing
around computeDistanceDocuments, so the exception costs the action its whole
ExtraHeuristicsDto, the SQL heuristics included. Two of those six are queries
the database answers normally: $regex against an array holding no strings, and
$not holding a bare regex.

The failing tests carry @disabled with the reason, following the convention of
the section at the end of MongoHeuristicsCalculatorTest. They are one per
defect, so they can be enabled independently and in any order.
@LautaroPetaccio

Copy link
Copy Markdown
Collaborator Author

Reopened as #1762 from a branch on this repo instead of a fork.

@LautaroPetaccio
LautaroPetaccio deleted the tests/mongo-heuristics-semantics-gaps branch September 14, 2026 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant