Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-28473

--noscripting option on mongod doesn't work

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: 3.5.4
    • Component/s: Security
    • Labels:
      None
    • ALL
    • Hide

      1. Run 'mongod --noscripting'
      2. Run mongo client 'mongo'
      3. Run command in mongo client:
      db.<collectionName>.find(

      {"$where":print("HI")}

      );
      4. Console logs of mongod prints out "HI" per document in collection

      Show
      1. Run 'mongod --noscripting' 2. Run mongo client 'mongo' 3. Run command in mongo client: db.<collectionName>.find( {"$where":print("HI")} ); 4. Console logs of mongod prints out "HI" per document in collection

      As per documentation at:
      https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-execution-of-javascript

      --noscripting option when passed to mongod, doesn't stop any '$where' executions.

            Assignee:
            mark.agarunov Mark Agarunov
            Reporter:
            krishna.devale Krishna
            Votes:
            0 Vote for this issue
            Watchers:
            10 Start watching this issue

              Created:
              Updated:
              Resolved: