Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-51688

mongod accepts yaml configuration file containing duplicate keys

    • Type: Icon: Bug Bug
    • Resolution: Won't Fix
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: 4.2.9, 4.4.1
    • Component/s: None
    • Labels:
      None
    • Server Security
    • ALL
      • Start a mongod standalone with the above yaml conf file
      • Check that the duplicate keys are merged in the getCmdLineOpts output

      A mongod process will start when pointed to a yaml configuration file that contains duplicate keys, for example see the following with duplicate 'net' key:

      net:
        bindIp: 0.0.0.0
        maxIncomingConnections: 5000
      net:
        port: 4000
      processManagement:
        fork: "true"
      storage:
        dbPath: /tmp/data/testProcess
      systemLog:
        destination: file
        path: /tmp/data/testProcess/mongodb.log
      

      It seems like the duplicate keys are merged:

      > db.adminCommand( { getCmdLineOpts: 1  } )
      {
      	"argv" : [
      		"/var/lib/mongodb-mms-automation/mongodb-macos-x86_64-4.4.1/bin/mongod",
      		"-f",
      		"/tmp/data/testProcess/automation-mongod.conf"
      	],
      	"parsed" : {
      		"config" : "/tmp/data/testProcess/automation-mongod.conf",
      		"net" : {
      			"bindIp" : "0.0.0.0",
      			"maxIncomingConnections" : 5000,
      			"port" : 4000
      		},
      		"processManagement" : {
      			"fork" : true
      		},
      		"storage" : {
      			"dbPath" : "/tmp/data/testProcess"
      		},
      		"systemLog" : {
      			"destination" : "file",
      			"path" : "/tmp/data/testProcess/mongodb.log"
      		}
      	},
      	"ok" : 1
      }
      

      I tested that this behavior occurs with the latest 4.4 and 4.2 releases.

      The YAML spec says that all keys should be unique, so I believe specifying such a YAML file should be rejected with an error.

      A configuration file using invalid YAML can cause problems with other tooling that parses these YAML files with alternative parsers.

            Assignee:
            backlog-server-security [DO NOT USE] Backlog - Security Team
            Reporter:
            dennis.kuczynski@mongodb.com Dennis Kuczynski
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: