[SERVER-28473] --noscripting option on mongod doesn't work Created: 24/Mar/17  Updated: 31/May/17  Resolved: 27/Mar/17

Status: Closed
Project: Core Server
Component/s: Security
Affects Version/s: 3.5.4
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: Krishna Assignee: Mark Agarunov
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Operating System: ALL
Steps To Reproduce:

1. Run 'mongod --noscripting'
2. Run mongo client 'mongo'
3. Run command in mongo client:
db.<collectionName>.find(

{"$where":print("HI")}

);
4. Console logs of mongod prints out "HI" per document in collection

Participants:

 Description   

As per documentation at:
https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-execution-of-javascript

--noscripting option when passed to mongod, doesn't stop any '$where' executions.



 Comments   
Comment by Krishna [ 25/Mar/17 ]

Hi Mark,

Thanks for your response.
The issue is on my side.
I had an alias for mongod as 'mongod --dbpath <path>'
On the alias when I use mongod --noscripting, mongod was not recognizing the option.

Even config file is very particular about indentation.
I am able to get the --noscripting feature to work now.

Thanks,
Krishna

Comment by Mark Agarunov [ 24/Mar/17 ]

Hello krishna.devale,

Thank you for the report. Unfortunately, we have not been able to reproduce this. With --noscripting passed to mongod I'm seeing:

Marks-MacBook-Pro(mongod-3.5.4) test> db.test.find( {$where:function(){print("TEST"); return true;}} );
Error: error: {
  "ok": 0,
  "errmsg": "no globalScriptEngine in $where parsing",
  "code": 2,
  "codeName": "BadValue",
  "operationTime": Timestamp(0, 0)
}

And no output in the server logs.

Without --noscripting TEST is printed in the server logs.

Thanks,
Mark

Generated at Thu Feb 08 04:18:14 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.