Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-48621

[v4.4] userAllowedCreateNS() does not check the collection name length in FCV4.4

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 4.4.0-rc9
    • Affects Version/s: 4.4.0-rc8
    • Component/s: Storage
    • Labels:
      None
    • Fully Compatible
    • ALL
    • Hide

      Here's a jstests/replsets repro:

       

      (function() {
var name = "test";

var replSetTest = new ReplSetTest({name: name, nodes: 2});
replSetTest.startSet();
var hostnames = replSetTest.nodeList();
replSetTest.initiate({
    "_id": name,
    "members": [
        {"_id": 0, "host": hostnames[0], "priority": 2},
        {"_id": 1, "host": hostnames[1], priority: 0}
    ]
});

var master = replSetTest.getPrimary();

const db = master.getDB("test");
assert.commandWorked(db.createCollection("a"));

assert.commandFailedWithCode(db.adminCommand({renameCollection: "test.a", to: "test.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"}), [ErrorCodes.IllegalOperation]);

assert.commandFailedWithCode(db.adminCommand({renameCollection: "test.a", to: "test2.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"}), [ErrorCodes.IllegalOperation]);

replSetTest.stopSet();
}());
      Show
      Here's a jstests/replsets repro:   (function() { var name = "test" ; var replSetTest = new ReplSetTest({name: name, nodes: 2}); replSetTest.startSet(); var hostnames = replSetTest.nodeList(); replSetTest.initiate({ "_id" : name, "members" : [ { "_id" : 0, "host" : hostnames[0], "priority" : 2}, { "_id" : 1, "host" : hostnames[1], priority: 0} ] }); var master = replSetTest.getPrimary(); const db = master.getDB( "test" ); assert .commandWorked(db.createCollection( "a" )); assert .commandFailedWithCode(db.adminCommand({renameCollection: "test.a" , to: "test.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111" }), [ErrorCodes.IllegalOperation]); assert .commandFailedWithCode(db.adminCommand({renameCollection: "test.a" , to: "test2.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111" }), [ErrorCodes.IllegalOperation]); replSetTest.stopSet(); }());
    • Execution Team 2020-06-15

      We have two different code paths where we check the collection name length.

      DatabaseImpl::_checkCanCreateCollection() and userAllowedCreateNS().

      The latter function only checks the collection namespace length when running in FCV 4.2, but performs no length checks for FCV 4.4. Renaming a collection within the same database goes through userAllowedCreateNS() as it only needs to modify the catalog's metadata and allows the opportunity to create a collection with a name > 255 characters.

       

      To fix this, we should add the non-FCV namespace length check from _checkCanCreateCollection() into userAllowedCreateNS() too.

            Assignee:
            gregory.wlodarek@mongodb.com Gregory Wlodarek
            Reporter:
            gregory.wlodarek@mongodb.com Gregory Wlodarek
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: