-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Critical - P2
-
Affects Version/s: None
-
Component/s: None
-
5
-
-
None
-
0.2
-
PHP Drivers
-
Not Needed
-
None
-
None
-
None
-
None
-
None
-
None
Split from DRIVERS-3600. See that ticket for the full description.
The low-level ext-mongodb API does not validate namespaces. MongoDB\Driver\Manager::executeBulkWrite accepts a concatenated db.coll namespace string and forwards it to libmongoc, which uses NUL-terminated C strings. A NUL byte truncates the name silently, and extra periods split the namespace at the first period. Both change the effective namespace before the command reaches the server, so the server cannot detect the problem.
The high-level mongodb/mongodb library already validates (see PHPLIB-1927). This ticket adds the same client-side validation to the ext-mongodb low-level API.
Empirical results (ext-mongodb 2.4.0dev, mongod 7.0.16, Manager::executeBulkWrite):
- Namespace testdb.foo\0bar: inserted with no error; the document landed in testdb.foo because the NUL truncated "bar". This is a silent retargeting.
- Namespace foo\0bar.coll: client error "Invalid namespace provided: foo". The NUL truncated the whole namespace to a value with no period, which the driver rejects. This guard is incidental.
- Namespace a.b.c: inserted with no error; created database a, collection b.c (split at the first period).
- executeCommand with $db = foo\0bar: command accepted, no client error.
Required behavior (per DRIVERS-3600):
- Reject a NUL byte in a database or collection name with a client-side error, before the command is sent.
- Reject a period in a database name.
- A period in a collection name stays valid.
This applies to the low-level namespace and $db handling (executeBulkWrite, executeQuery, executeCommand). Coordinate with libmongoc (CDRIVER-6424).
- related to
-
PHPLIB-1927 Validate database and collection name arguments against "." and NUL bytes
-
- Closed
-