[SERVER-37058] Update with numeric field names inside an array can cause validation to fail Created: 07/Sep/18  Updated: 29/Oct/23  Resolved: 04/Oct/18

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: None
Fix Version/s: 3.4.18, 3.6.9, 4.0.4, 4.1.4

Type: Bug Priority: Critical - P2
Reporter: Ian Boros Assignee: Nicholas Zolnierz
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v4.0, v3.6, v3.4, v3.2
Sprint: Query 2018-10-08
Participants:
Linked BF Score: 50

 Description   

Full repro:

(function() {
    const c = db.coll;
    c.drop();
    c.insert({'a': [{}]});
    assert.commandWorked(c.createIndex({'a.0.c': 1}));
    // First 0 is array index.
    // Second 0 is a field name.
    c.update({}, {$set: {'a.0.0.b': 'hi'}});
    const res = assert.commandWorked(c.validate(true));
    assert(res.valid, tojson(res));
})();

Step 1: Insert a document such as:

{'a': [{}]}

Step 2: Create an index, such as:

{'a.0.c': 1}

The key for the document we inserted above is null.

Now do an update:

c.update({}, {$set: {'a.0.0.b': 'hi'}});

The update driver determines that this change will not affect any indexes, so the index keys don't get recomputed.

But when we run validate(), they do get recomputed, and as part of that, validation fails
because we have a numerical field name in an object nested inside an array:
https://github.com/mongodb/mongo/blob/a8fe1d82c3c5484c7e8a6402a34bc45ea11d06f1/src/mongo/db/index/btree_key_generator.cpp#L261-L268

One way to fix this is to just add a special check to the update code.



 Comments   
Comment by Githook User [ 11/Oct/18 ]

Author:

{'name': 'Nick Zolnierz', 'email': 'nicholas.zolnierz@mongodb.com', 'username': 'nzolnierzmdb'}

Message: SERVER-37058: Update with numeric field names inside an array can cause validation to fail
Branch: v3.4
https://github.com/mongodb/mongo/commit/11cd6942b2ec32e9079ad1b979c6eba544beda41

Comment by Githook User [ 11/Oct/18 ]

Author:

{'name': 'Nick Zolnierz', 'email': 'nicholas.zolnierz@mongodb.com', 'username': 'nzolnierzmdb'}

Message: SERVER-37058: Update with numeric field names inside an array can cause validation to fail
Branch: v3.6
https://github.com/mongodb/mongo/commit/952bf4a9daa5535f2c51caf33f54748a8867db5f

Comment by Githook User [ 11/Oct/18 ]

Author:

{'name': 'Nick Zolnierz', 'email': 'nicholas.zolnierz@mongodb.com', 'username': 'nzolnierzmdb'}

Message: SERVER-37058: Fix lint
Branch: v4.0
https://github.com/mongodb/mongo/commit/6114e241de404f6415a5a79b5e736ff96c190dd6

Comment by Githook User [ 11/Oct/18 ]

Author:

{'name': 'Nick Zolnierz', 'email': 'nicholas.zolnierz@mongodb.com', 'username': 'nzolnierzmdb'}

Message: SERVER-37058: Update with numeric field names inside an array can cause validation to fail

This is a simpler version of the fix on master to allow for an easier
backport.
Branch: v4.0
https://github.com/mongodb/mongo/commit/29813edbe168c2f3fe17cc27740f43868e414372

Comment by Githook User [ 04/Oct/18 ]

Author:

{'name': 'Nick Zolnierz', 'email': 'nicholas.zolnierz@mongodb.com', 'username': 'nzolnierzmdb'}

Message: SERVER-37058: Update with numeric field names inside an array can cause validation to fail
Branch: master
https://github.com/mongodb/mongo/commit/41820e4b371e389e8cbe965dc9aff14f657a9040

Comment by Ian Boros [ 07/Sep/18 ]

A fun fact that I've noticed while working on this ticket is that this update is a noop (to reproduce, try pasting it in my above repro as a replacement for the other update).

c.update({}, {$set: {'a.0.0': 'hi'}});

Seems like we should do something about this too.

Generated at Thu Feb 08 04:44:51 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.