Validate database and collection name arguments against "." and NUL bytes

XMLWordPrintableJSON

    • 5
    • Hide

      DRIVERS-3600:
      Summary of necessary driver changes

      • Return error if "." is used in a database name.
      • Return error if NUL is used in a database or collection name.
      • Implement prose tests.

      This addresses a possible driver bug: a driver's encoding of database/collection may silently re-interpret the sent database/collection and bypass server validation. If a driver already passes the database and collection names as-is to the server, the server returns an error, and there is no driver bug.

      Commits for syncing spec/prose tests
      (and/or refer to an existing language POC if needed)

      PRs are currently in private forks in GitHub Security Advisories.

      Context for other referenced/linked tickets

      • SECBUG-4155 tracks the original report in PHP. A separate SECBUG is expected for each affected driver.
      Show
      DRIVERS-3600: Summary of necessary driver changes Return error if "." is used in a database name. Return error if NUL is used in a database or collection name. Implement prose tests. This addresses a possible driver bug: a driver's encoding of database/collection may silently re-interpret the sent database/collection and bypass server validation. If a driver already passes the database and collection names as-is to the server, the server returns an error, and there is no driver bug. Commits for syncing spec/prose tests (and/or refer to an existing language POC if needed) PRs are currently in private forks in GitHub Security Advisories. Spec and prose tests: https://github.com/mongodb/specifications-ghsa-5fvv-9555-ggcp/pull/1 C POC: https://github.com/mongodb/mongo-c-driver-ghsa-c9qr-rh56-vvrc/pull/1 Rust POC: https://github.com/mongodb/mongo-rust-driver-ghsa-rx97-q5cv-gv89/pull/2 Context for other referenced/linked tickets SECBUG-4155 tracks the original report in PHP. A separate SECBUG is expected for each affected driver.
    • None
    • 0.2
    • Not Needed
    • None
    • None
    • None
    • None
    • None
    • None

      This ticket was split from DRIVERS-3600, please see that ticket for a detailed description.

            Assignee:
            Jérôme Tamarelle
            Reporter:
            TPM Jira Automations Bot
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: