[SERVER-13503] The $where operator should not be allowed under $elemMatch Created: 07/Apr/14  Updated: 11/Mar/15  Resolved: 16/Apr/14

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: 2.6.0-rc3
Fix Version/s: 2.6.1, 2.7.0

Type: Bug Priority: Major - P3
Reporter: J Rassi Assignee: Benety Goh
Resolution: Done Votes: 0
Labels: 26qa
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
is duplicated by SERVER-14010 Use of $where within $elemMatch Closed
Related
related to SERVER-14892 Invalid {$elemMatch: {$where}} query ... Closed
is related to SERVER-12439 $where in $elemMatch no longer valid ... Closed
is related to DOCS-3449 Doc that $where must be top-level Closed
Backwards Compatibility: Major Change
Operating System: ALL
Backport Completed:
Participants:

 Description   
Issue Status as of April 17, 2014

ISSUE SUMMARY
The $where operator applies to top-level elements only, however in 2.4 the specific implementation allowed usage under a sub-field within the $elemMatch operator as an edge case. This behavior was unintentional. With the introduction of the new query engine in 2.6 the $where usage should have been removed in the $elemMatch operator. The special case of $where as the first condition was missed.

USER IMPACT
As the behavior has changed from 2.4.9 some queries relying on the $where operator in $elemMatch may no longer work and return an error instead.

WORKAROUNDS
In most cases, a rewrite of the query and replacement of $where clauses in the $elemMatch document should be possible.

RESOLUTION
Consistent rejection of the $where operator anywhere in $elemMatch queries, with a clear error message.

AFFECTED VERSIONS
Version 2.6.0 was affected by this bug.

PATCHES
The patch is included in the 2.6.1 production release.

Original description

If the first listed condition in an $elemMatch is a $where predicate, the query will not parse.

> db.version()
2.6.0-rc3
> db.foo.insert({a:[{b:1,c:2},{b:2,c:1}]})
WriteResult({ "nInserted" : 1 })
> db.foo.insert({a:[{b:1,c:1}]})
WriteResult({ "nInserted" : 1 })
> db.foo.find({a:{$elemMatch:{b:1,$where:'this.c==1;'}}})
{ "_id" : ObjectId("5342e26193252aaba7ab9f74"), "a" : [ { "b" : 1, "c" : 1 } ] }
> db.foo.find({a:{$elemMatch:{$where:'this.c==1;',b:1}}})
error: {
	"$err" : "Can't canonicalize query: BadValue unknown operator: $where",
	"code" : 17287
}

The query parses correctly in 2.4.9.

> db.version()
2.4.9
> db.foo.find({a:{$elemMatch:{$where:'this.c==1;',b:1}}})
{ "_id" : ObjectId("5342e26193252aaba7ab9f74"), "a" : [ { "b" : 1, "c" : 1 } ] }



 Comments   
Comment by Githook User [ 16/Apr/14 ]

Author:

{u'username': u'benety', u'name': u'Benety Goh', u'email': u'benety@mongodb.com'}

Message: SERVER-13503 disallow $where under $elemMatch value
(cherry picked from commit 5aac10481a602c2ca3ce1d24a0c97e3602e33814)
Branch: v2.6
https://github.com/mongodb/mongo/commit/b39c5ee1eaf1507e7f9149330520e01d5c060340

Comment by Githook User [ 16/Apr/14 ]

Author:

{u'username': u'benety', u'name': u'Benety Goh', u'email': u'benety@mongodb.com'}

Message: SERVER-13503 disallow $where under $elemMatch value
Branch: master
https://github.com/mongodb/mongo/commit/5aac10481a602c2ca3ce1d24a0c97e3602e33814

Generated at Thu Feb 08 03:31:55 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.