[SERVER-43287] Prevent $merge from outputting to system collections Created: 11/Sep/19  Updated: 29/Oct/23  Resolved: 21/Oct/19

Status: Closed
Project: Core Server
Component/s: Aggregation Framework
Affects Version/s: None
Fix Version/s: 4.3.1

Type: Improvement Priority: Major - P3
Reporter: Charlie Swanson Assignee: Mihai Andrei
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: Text File WIP.patch    
Issue Links:
Problem/Incident
causes PYTHON-2023 Test failure - test.test_database.Tes... Closed
Related
related to SERVER-43020 New mapReduce -> agg path on mongos f... Closed
is related to SERVER-43286 Prevent mapReduce from outputting to ... Closed
Backwards Compatibility: Minor Change
Sprint: Query 2019-10-21, Query 2019-11-04
Participants:

 Description   

$out has a check to disallow writing to system collections which I think should be added to $merge.

Also to consider, I don't know of any restrictions on which database you can write to. We may wish to disallow writing to "admin", "config", and "local" as well.

If we don't change anything, we need more tests at the very least.



 Comments   
Comment by Shane Harvey [ 25/Oct/19 ]

Note that this is a minor breaking change since it's no longer possible to use $currentOp and $listLocalSessions with $out. This caused the test failure it PYTHON-2023.

Comment by Githook User [ 21/Oct/19 ]

Author:

{'name': 'Mihai Andrei', 'email': 'mihai.andrei@mongodb.com'}

Message: SERVER-43287 Prevent from outputting to system collections
Branch: master
https://github.com/mongodb/mongo/commit/0d740a44335d3835ad0e947115c6fc8cf5e2122f

Comment by Charlie Swanson [ 11/Sep/19 ]

Started working on this as part of SERVER-43020 but decided it was worth it's own ticket and triage. Attached WIP.patch which is as far as I got.

Generated at Thu Feb 08 05:02:46 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.