[SERVER-30157] $type parsing should reject non-integral type codes Created: 14/Jul/17  Updated: 30/Oct/23  Resolved: 17/Oct/17

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: 3.5.10
Fix Version/s: 3.6.0-rc1

Type: Bug Priority: Major - P3
Reporter: David Storch Assignee: Blake Oler
Resolution: Fixed Votes: 0
Labels: neweng
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Problem/Incident
causes SERVER-31623 MatcherTypeSet::parseSingleType() sho... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: Query 2017-10-23
Participants:

 Description   

Instead of failing, $type parsing converts a non-integral type code to -1, which is the type code for MinKey:

> db.c.drop()
true
> db.c.insert({a: 1})
WriteResult({ "nInserted" : 1 })
> db.c.insert({a: MinKey()})
WriteResult({ "nInserted" : 1 })
> db.c.insert({a: "foo"})
WriteResult({ "nInserted" : 1 })
> db.c.insert({a: MaxKey()})
WriteResult({ "nInserted" : 1 })
> db.c.find({a: {$type: -1}})
{ "_id" : ObjectId("596925106d078d9cebb74764"), "a" : { "$minKey" : 1 } }
> db.c.find({a: {$type: 1.5}})
{ "_id" : ObjectId("596925106d078d9cebb74764"), "a" : { "$minKey" : 1 } }
> db.c.find({a: {$type: 2.1}})
{ "_id" : ObjectId("596925106d078d9cebb74764"), "a" : { "$minKey" : 1 } }

This behavior is due to the parser implementation here:

https://github.com/mongodb/mongo/blob/9f317c119bef0a66ca1a2ed6617df87b2ed557d4/src/mongo/db/matcher/expression_parser.cpp#L703-L705



 Comments   
Comment by Githook User [ 17/Oct/17 ]

Author:

{'email': 'blake.oler@10gen.com', 'name': 'Blake Oler', 'username': 'BlakeIsBlake'}

Message: SERVER-30157 Reject non-integral type codes in $type parsing
Branch: master
https://github.com/mongodb/mongo/commit/bd0c03a8816985f74f7bd24245aa81f9cb5b37f7

Generated at Thu Feb 08 04:22:51 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.