Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-10747

$where operator can block all other operations

    • Type: Icon: Bug Bug
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: Concurrency
    • Environment:
      Operating System(s): Ubuntu 64bit Linux, Mac OS X 10.8.4
      MongoDB version(s): 2.4.5, 2.4.6
      Both in standalone and replica set configuration
      Drivers used: node.js - 1.2.12, python - 2.6.2
    • Query Execution
    • ALL
    • Hide

      1. Run a find query with the following filter on any collection:
      { "$where": "function() { while(true) {} }" }
      2. While this is running, try running another query against the same mongo instance (both queries can be against the same or different databases), this will block until the query in 1. is terminated by the server.

      Show
      1. Run a find query with the following filter on any collection: { "$where": "function() { while(true) {} }" } 2. While this is running, try running another query against the same mongo instance (both queries can be against the same or different databases), this will block until the query in 1. is terminated by the server.

      Malicious $where clauses for eg: containing an infinite loop, can cause all other operations to hang for 1 minute (as per SERVER-3 timeout on JS execution).

      While the guard functionality that terminates the JS execution works, it's unacceptable for mongo to be unresponsive to all other operations during this interval. Also, the documentation states that, as part of the JS improvements in 2.4, mongo can handle multiple JS operations concurrently.

      Steps to reproduce:
      1. Run a find query with the following filter on any collection:
      { "$where": "function() { while(true) {} }" }
      2. While this is running, try running another query against the same mongo instance (both queries can be against the same or different databases), this will block until the query in 1. is terminated by the server.

      Attached is a python script (testcase.py) that demonstrates this using the python driver.

      First, run the setup script:
      python testsetup.py

      Then, run 1 instance of the script providing a command line argument like so:
      python testcase.py hang

      Concurrently run another instance of the script without a command line arg:
      python testcase.py

        1. testsetup.py
          0.2 kB
        2. testcase.py
          0.3 kB

            Assignee:
            backlog-query-execution [DO NOT USE] Backlog - Query Execution
            Reporter:
            bhangm Shubhang Mani
            Votes:
            1 Vote for this issue
            Watchers:
            17 Start watching this issue

              Created:
              Updated: