Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-62827

Prevent rpc::upconvertRequest from erroneously duplicating top-level $readPreference field in command object

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 5.3.0
    • Affects Version/s: None
    • Component/s: None
    • Fully Compatible
    • ALL
    • Hide 
      (function() {
'use strict';

load("jstests/libs/override_methods/set_read_preference_secondary.js");

var st = new ShardingTest({shards: 2});

st.s0.getDB('db').runCommand({
    find: 'foo',
    $readPreference: {
        mode: 'nearest'
    },
});

st.stop();
})();
      Show
      (function() { 'use strict' ; load( "jstests/libs/override_methods/set_read_preference_secondary.js" ); var st = new ShardingTest({shards: 2}); st.s0.getDB( 'db' ).runCommand({ find: 'foo' , $readPreference: { mode: 'nearest' }, }); st.stop(); })();
    • Service Arch 2022-2-07, Service Arch 2022-2-21
    • 64
    • 3

      Scenario

      On a debug build of a MongoDB cluster:

      1. A commandObj passed into runCommandWithReadPreferenceSecondary here has the $readPreference field specified at the top level.
      2. The commandObj is wrapped in a query object here, meaning that the original $readPreference object is now at the second level.
      3. The function checks here if the top level of the object has the $readPreference field (it does not).
      4. The function adds a $readPreference field – the BSONObj now has two $readPreference fields.
      5. rpc::upconvertRequest() adds the $readPreference field from the query object to the top level erroneously.
      6. The shell crashes when attempting to send the commandObj, because the $readPreference field was duplicated.

      There's reason to believe this could also happen with an old driver sending OP_QUERY messages and specifying a readPreference on both the query object and the top-level, but I wasn't able to reproduce it easily.

      Suggested fix

      Throw ErrorCodes::InvalidOptions in rpc::upconvertRequest() if there is a $readPreference specified in both the query object and the top level.

            Assignee:
            blake.oler@mongodb.com Blake Oler
            Reporter:
            blake.oler@mongodb.com Blake Oler
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: