Disable server-side JS stages by default

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Done
    • Priority: Major - P3
    • 1.13.0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Needed
    • Hide

      Adds a new setting for disabling server-side js - it's called `disableServerSideJs` and is true by default. It disables operators such as $where or $function that could result in JS being executed by the server.

      Show
      Adds a new setting for disabling server-side js - it's called `disableServerSideJs` and is true by default. It disables operators such as $where or $function that could result in JS being executed by the server.
    • Developer Tools

      $where, $function, and $accumulator run js on the server, which may result in extremely DOS if the agent crafts a sufficiently bad function. We should disable by default and allow users to re-enable if they have a legitimate use case for it.

            Assignee:
            Nikola Irinchev
            Reporter:
            Nikola Irinchev
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: