Validate database and collection name arguments against "." and NUL bytes

XMLWordPrintableJSON

    • Hide

      DRIVERS-3600:
      Summary of necessary driver changes

      • Return error if "." is used in a database name.
      • Return error if NUL is used in a database or collection name.
      • Implement prose tests.

      This addresses a possible driver bug: a driver's encoding of database/collection may silently re-interpret the sent database/collection and bypass server validation. If a driver already passes the database and collection names as-is to the server, the server returns an error, and there is no driver bug.

      Commits for syncing spec/prose tests
      (and/or refer to an existing language POC if needed)

      PRs are currently in private forks in GitHub Security Advisories.

      Context for other referenced/linked tickets

      • SECBUG-4155 tracks the original report in PHP. A separate SECBUG is expected for each affected driver.
      Show
      DRIVERS-3600: Summary of necessary driver changes Return error if "." is used in a database name. Return error if NUL is used in a database or collection name. Implement prose tests. This addresses a possible driver bug: a driver's encoding of database/collection may silently re-interpret the sent database/collection and bypass server validation. If a driver already passes the database and collection names as-is to the server, the server returns an error, and there is no driver bug. Commits for syncing spec/prose tests (and/or refer to an existing language POC if needed) PRs are currently in private forks in GitHub Security Advisories. Spec and prose tests: https://github.com/mongodb/specifications-ghsa-5fvv-9555-ggcp/pull/1 C POC: https://github.com/mongodb/mongo-c-driver-ghsa-c9qr-rh56-vvrc/pull/1 Rust POC: https://github.com/mongodb/mongo-rust-driver-ghsa-rx97-q5cv-gv89/pull/2 Context for other referenced/linked tickets SECBUG-4155 tracks the original report in PHP. A separate SECBUG is expected for each affected driver.
    • None
    • Not Needed
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      This ticket was split from DRIVERS-3600, please see that ticket for a detailed description.

            Assignee:
            Isabel Atkinson
            Reporter:
            TPM Jira Automations Bot
            None
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: