[SERVER-18046] security.javascriptEnabled allows aggregation with $group stage Created: 14/Apr/15  Updated: 15/Apr/15  Resolved: 14/Apr/15

Status: Closed
Project: Core Server
Component/s: JavaScript, Security
Affects Version/s: 2.6.5
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: Salim B. Assignee: Unassigned
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
related to DOCS-5210 Unfinished sentence in docs for javas... Closed
Operating System: ALL
Steps To Reproduce:

Set javascriptEnabled to false, restart all servers in replica set, and try to execute a JS job.

Participants:

 Description   

Hi all !

I'm currently using MongoDB from EPEL7 repos (version 2.6.5) and on RHEL7 (replica set deployment). I've changed the default configuration file to switch to the YAML format and set the "javascriptEnabled" to false, which seems to have no effect.

From mongod logs, I checked that parameter is read :

2015-04-01T15:57:42.800+0200 [initandlisten] options: { command: [ "run" ], config: "/etc/mongodb.conf", net: { bindIp: "10.33.48.29,127.0.0.1", port: 27017 }, processManagement: { fork: true, pidFilePath: "/var/run/mongodb/mongod.pid" }, replication: { oplogSizeMB: 10240, replSetName: "rs0" }, security: { authorization: "enabled", javascriptEnabled: false, keyFile: "/var/lib/mongodb/mongod-key" }, storage: { dbPath: "/var/lib/mongodb", directoryPerDB: true, journal: { enabled: true } }, systemLog: { destination: "file", logAppend: true, path: "/var/log/mongodb/mongodb.log", quiet: true } }

Then, we tried this JS function :

db.client.aggregate({$group: {
    _id : '$name',
    total : { $sum : 1 }
   }
 })

and got a result.



 Comments   
Comment by Salim B. [ 14/Apr/15 ]

My bad, we used that group() function and got the expected result.
Sorry about that :/

Comment by Ramon Fernandez Marina [ 14/Apr/15 ]

sboulkour, the operation you posted is not db.collection.group() (which requires JavaScript) but db.collection.aggregate() with a $group pipeline stage, which does not require JavaScript.

Regards,
Ramón.

Generated at Thu Feb 08 03:46:23 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.