Validate and reject NUL bytes in namespaces passed to the low-level API

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Critical - P2
    • 1.21.6, 2.4.1
    • Affects Version/s: None
    • Component/s: None
    • 5
    • Hide

      DRIVERS-3600:
      Summary of necessary driver changes

      • Return error if "." is used in a database name.
      • Return error if NUL is used in a database or collection name.
      • Implement prose tests.

      This addresses a possible driver bug: a driver's encoding of database/collection may silently re-interpret the sent database/collection and bypass server validation. If a driver already passes the database and collection names as-is to the server, the server returns an error, and there is no driver bug.

      Commits for syncing spec/prose tests
      (and/or refer to an existing language POC if needed)

      PRs are currently in private forks in GitHub Security Advisories.

      Context for other referenced/linked tickets

      • SECBUG-4155 tracks the original report in PHP. A separate SECBUG is expected for each affected driver.
      Show
      DRIVERS-3600: Summary of necessary driver changes Return error if "." is used in a database name. Return error if NUL is used in a database or collection name. Implement prose tests. This addresses a possible driver bug: a driver's encoding of database/collection may silently re-interpret the sent database/collection and bypass server validation. If a driver already passes the database and collection names as-is to the server, the server returns an error, and there is no driver bug. Commits for syncing spec/prose tests (and/or refer to an existing language POC if needed) PRs are currently in private forks in GitHub Security Advisories. Spec and prose tests: https://github.com/mongodb/specifications-ghsa-5fvv-9555-ggcp/pull/1 C POC: https://github.com/mongodb/mongo-c-driver-ghsa-c9qr-rh56-vvrc/pull/1 Rust POC: https://github.com/mongodb/mongo-rust-driver-ghsa-rx97-q5cv-gv89/pull/2 Context for other referenced/linked tickets SECBUG-4155 tracks the original report in PHP. A separate SECBUG is expected for each affected driver.
    • None
    • 0.2
    • PHP Drivers
    • Not Needed
    • None
    • None
    • None
    • None
    • None
    • None

      Split from DRIVERS-3600. See that ticket for the full description.

      The low-level ext-mongodb API does not validate namespaces. MongoDB\Driver\Manager::executeBulkWrite accepts a concatenated db.coll namespace string and forwards it to libmongoc, which uses NUL-terminated C strings. A NUL byte truncates the name silently, and extra periods split the namespace at the first period. Both change the effective namespace before the command reaches the server, so the server cannot detect the problem.

      The high-level mongodb/mongodb library already validates (see PHPLIB-1927). This ticket adds the same client-side validation to the ext-mongodb low-level API.

      Empirical results (ext-mongodb 2.4.0dev, mongod 7.0.16, Manager::executeBulkWrite):

      • Namespace testdb.foo\0bar: inserted with no error; the document landed in testdb.foo because the NUL truncated "bar". This is a silent retargeting.
      • Namespace foo\0bar.coll: client error "Invalid namespace provided: foo". The NUL truncated the whole namespace to a value with no period, which the driver rejects. This guard is incidental.
      • Namespace a.b.c: inserted with no error; created database a, collection b.c (split at the first period).
      • executeCommand with $db = foo\0bar: command accepted, no client error.

      Required behavior (per DRIVERS-3600):

      • Reject a NUL byte in a database or collection name with a client-side error, before the command is sent.
      • Reject a period in a database name.
      • A period in a collection name stays valid.

      This applies to the low-level namespace and $db handling (executeBulkWrite, executeQuery, executeCommand). Coordinate with libmongoc (CDRIVER-6424).

            Assignee:
            Jérôme Tamarelle
            Reporter:
            Jérôme Tamarelle
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: