-
Type:
Improvement
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: Shell
-
Labels:
-
Fully Compatible
-
v4.2
-
Security 2019-11-04, Security 2019-11-18
Currently issuing an unsupported query or agg operator via an auto-encrypt enabled shell session returns errors that are *not* easily distinguished as mongocryptd-originating:
> coll.aggregate([{$project : {"date" : {$dateToParts : {"date" : "$date"}}}}])
2019-10-08T11:18:47.872-0400 E QUERY [js] Error: Encrypted field 'date' is not allowed to be evaluated by date to parts function :
runClientFunctionWithRetries@src/mongo/shell/session.js:366:27
runCommand@src/mongo/shell/session.js:460:25
DB.prototype._runCommandImpl@src/mongo/shell/db.js:147:12
DB.prototype.runCommand@src/mongo/shell/db.js:162:16
DB.prototype.runReadCommand@src/mongo/shell/db.js:141:12
DB.prototype._runAggregate/doAgg<@src/mongo/shell/db.js:245:60
DB.prototype._runAggregate@src/mongo/shell/db.js:248:17
DBCollection.prototype.aggregate@src/mongo/shell/collection.js:1012:12
@(shell):1:1
Queries have a very different error report string:
> coll.find({"date" : {$gt : Date("2019-01-01")}})
Error: Invalid match expression operator on encrypted field 'date': { date: { $gt: "Tue Oct 08 2019 11:23:57 GMT-0400 (EDT)" } }
Since these errors do not include any indicator that they originated from mongocryptd, its not as clear to the user where mongocryptd's query validation is taking place. These look like any other syntax error, rather than a 'this behavior is blocked by mongocryptd'
This might be a wider issue than just the shell, but I figure we can start talking about whether this makes sense to deal with here.