Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-48621

[v4.4] userAllowedCreateNS() does not check the collection name length in FCV4.4

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major - P3 Major - P3
    • 4.4.0-rc9
    • 4.4.0-rc8
    • Storage
    • None
    • Fully Compatible
    • ALL
    • Hide

      Here's a jstests/replsets repro:

       

      (function() {
      var name = "test";
       
      var replSetTest = new ReplSetTest({name: name, nodes: 2});
      replSetTest.startSet();
      var hostnames = replSetTest.nodeList();
      replSetTest.initiate({
          "_id": name,
          "members": [
              {"_id": 0, "host": hostnames[0], "priority": 2},
              {"_id": 1, "host": hostnames[1], priority: 0}
          ]
      });
       
      var master = replSetTest.getPrimary();
       
      const db = master.getDB("test");
      assert.commandWorked(db.createCollection("a"));
       
      assert.commandFailedWithCode(db.adminCommand({renameCollection: "test.a", to: "test.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"}), [ErrorCodes.IllegalOperation]);
       
      assert.commandFailedWithCode(db.adminCommand({renameCollection: "test.a", to: "test2.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"}), [ErrorCodes.IllegalOperation]);
       
      replSetTest.stopSet();
      }());
      
      

      Show
      Here's a jstests/replsets repro:   (function() { var name = "test" ;   var replSetTest = new ReplSetTest({name: name, nodes: 2 }); replSetTest.startSet(); var hostnames = replSetTest.nodeList(); replSetTest.initiate({ "_id" : name, "members" : [ { "_id" : 0 , "host" : hostnames[ 0 ], "priority" : 2 }, { "_id" : 1 , "host" : hostnames[ 1 ], priority: 0 } ] });   var master = replSetTest.getPrimary();   const db = master.getDB( "test" ); assert .commandWorked(db.createCollection( "a" ));   assert .commandFailedWithCode(db.adminCommand({renameCollection: "test.a" , to: "test.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111" }), [ErrorCodes.IllegalOperation]);   assert .commandFailedWithCode(db.adminCommand({renameCollection: "test.a" , to: "test2.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111" }), [ErrorCodes.IllegalOperation]);   replSetTest.stopSet(); }());
    • Execution Team 2020-06-15

    Description

      We have two different code paths where we check the collection name length.

      DatabaseImpl::_checkCanCreateCollection() and userAllowedCreateNS().

      The latter function only checks the collection namespace length when running in FCV 4.2, but performs no length checks for FCV 4.4. Renaming a collection within the same database goes through userAllowedCreateNS() as it only needs to modify the catalog's metadata and allows the opportunity to create a collection with a name > 255 characters.

       

      To fix this, we should add the non-FCV namespace length check from _checkCanCreateCollection() into userAllowedCreateNS() too.

      Attachments

        Activity

          People

            gregory.wlodarek@mongodb.com Gregory Wlodarek
            gregory.wlodarek@mongodb.com Gregory Wlodarek
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: