[SERVER-32952] applyOps does not validate updates Created: 29/Jan/18  Updated: 06/Dec/22

Status: Backlog
Project: Core Server
Component/s: Replication, Write Ops
Affects Version/s: 3.4.10, 3.6.2, 3.7.1
Fix Version/s: None

Type: Bug Priority: Major - P3
Reporter: Tess Avitabile (Inactive) Assignee: Backlog - Replication Team
Resolution: Unresolved Votes: 0
Labels: applyOps
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Related
related to SERVER-43329 renameCollectionWithinDBForApplyOps s... Backlog
related to SERVER-53674 Do not run applyOps commands in the f... Closed
related to SERVER-58247 Using createIndexes in applyOps with ... Closed
related to SERVER-36263 Bypassing operation validation in app... Closed
is related to SERVER-32305 Able to create document with array as... Backlog
is related to SERVER-32941 applyOps command inserts documents wi... Backlog
is related to SERVER-35248 Use ReplOperation IDL to reject malfo... Backlog
is related to SERVER-36195 applyOps accepts invalid op types Backlog
is related to SERVER-36593 applyOps may not include _id in oplog... Backlog
is related to SERVER-32934 Full document replacement can change ... Closed
is related to SERVER-36950 applyOps createIndexes command with n... Closed
is related to SERVER-36955 applyOps accepts invalid UUIDs for th... Closed
is related to SERVER-30798 Disallow running applyOps with a rena... Backlog
is related to SERVER-27096 applyOps should validate its ops to e... Backlog
Assigned Teams:
Replication
Operating System: ALL
Steps To Reproduce:

> db.c.insert({_id: 1})
WriteResult({ "nInserted" : 1 })
> db.adminCommand({applyOps: [{op: 'u', ns: 'test.c', o: {_id: 1, $bad: 1}, o2: {_id: 1}}]})
{ "applied" : 1, "results" : [ true ], "ok" : 1 }
> db.c.find()
{ "_id" : 1, "$bad" : 1 }

Participants:
Linked BF Score: 18

 Description   

The update command will validate updates for modified immutable fields, $-prefixed fields, BSON depth, etc. When updates are performed through applyOps, this validation is not performed.



 Comments   
Comment by Steven Vannelli [ 03/Oct/19 ]

We will close these bug tickets and address the underlying issue within the Operationalize Mongo Mirror project.

Comment by Andy Schwerin [ 30/Jan/18 ]

If primary nodes might generate such oplog entries, applyOps needs to be able to apply them at least for mongomirror and mongorestore. This will present some challenges.

Generated at Thu Feb 08 04:31:49 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.