[SERVER-1988] Upsert allows inserting records with dots in key names Created: 22/Oct/10  Updated: 12/Jul/16  Resolved: 17/Dec/10

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: 1.6.2
Fix Version/s: 1.7.4

Type: Bug Priority: Minor - P4
Reporter: Andrew Bayliss Assignee: Antoine Girbal
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

linux 32 bit


Operating System: Linux
Participants:

 Description   

Insert does not allow inserting records with fields containing keys with dots in them, which as I understand it is the correct behaviour. An upsert however, will perfectly happily do this:

> db.test.insert(

{ "test": 1, "te.st": 1 }

);
Fri Oct 22 17:13:37 uncaught exception: can't have . in field names [te.st]
> db.test.update(

{ "test": 1 }

,

{ "test": 1, "te.st": 1 }

, 1);
> db.test.find()

{ "_id" : ObjectId("4cc1b8371c20e0349d6568ad"), "test" : 1, "te.st" : 1 }

 Comments   
Comment by auto [ 17/Dec/10 ]

Author:

{u'login': u'agirbal', u'name': u'agirbal', u'email': u'antoine@10gen.com'}

Message: SERVER-1988: added unit test
https://github.com/mongodb/mongo/commit/4f10562afc2e8aed5b978ed858c223325c45e907

Comment by Antoine Girbal [ 17/Dec/10 ]

did following tests on patch

> db.dot.insert(

{"a": 0,"b": 1}

)
> db.dot.insert(

{"a": 0,"b.b": 1}

)
Thu Dec 16 23:07:33 uncaught exception: can't have . in field names [b.b]
> db.dot.update(

{"a": 0}

,

{"b.b": 1}

)
Thu Dec 16 23:07:58 uncaught exception: can't have . in field names [b.b]
> db.dot.findOne()

{ "_id" : ObjectId("4d0b0c592bc8d37d2a1dfd78"), "a" : 0, "b" : 1 }

> db.dot.update(

{"a": 0}

, {$set: { "c.c": 1}})
> db.dot.findOne()
{
"_id" : ObjectId("4d0b0c592bc8d37d2a1dfd78"),
"a" : 0,
"b" : 1,
"c" :

{ "c" : 1 }

}
> db.dot.update(

{"a": 0}

, {"": { "c.c": 1}})
Fri Dec 17 00:10:19 uncaught exception: can't have . in field names [c.c]
> db.dot.update(

{"a": 0}

, {})
> db.dot.findOne()

{ "_id" : ObjectId("4d0b0c592bc8d37d2a1dfd78") }
Comment by auto [ 17/Dec/10 ]

Author:

{u'login': u'agirbal', u'name': u'agirbal', u'email': u'antoine@10gen.com'}

Message: SERVER-1988: Upsert allows inserting records with dots in key names
https://github.com/mongodb/mongo/commit/28904fa7ae991355a1043da387328ad98bb0ac84

Comment by Eliot Horowitz (Inactive) [ 17/Dec/10 ]

That sounds right.

Comment by Antoine Girbal [ 17/Dec/10 ]

Ok so as agreed, the fix goes into the shell, not db since it does not inspect full obj.
But "." is actually allowed in field names in case an object is modified (instead of overwritten).
So the fix would be:

  • if 1st field name of update starts with "$", do not check
  • otherwise apply same validation as insert
Comment by Eliot Horowitz (Inactive) [ 14/Dec/10 ]

We only have to inspect the update spec, not the resulting object.
The update spec is going to be small even if the resulting object is huge.

Can probably rename and reuse checkNoMods, but its been a while

Comment by Antoine Girbal [ 13/Dec/10 ]

it looks to me that we do not run a complete parse of the update object at any point of the processing.
For both insert and update, the db pretty much takes the object as is.
If we want to catch this we have to traverse the object to check all the keys.

Comment by Eliot Horowitz (Inactive) [ 13/Dec/10 ]

For update it does have some protection in update.cpp
we should enhance update there

Comment by Antoine Girbal [ 13/Dec/10 ]

basically mongodb does not reject key names with ".", it's at the driver's discretion.
we can fix the shell to check for it, but ultimately shouldnt mongodb have its own protection against it?

Generated at Thu Feb 08 02:58:38 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.