[SERVER-44154] Consider making FCV checks for $-prefixed field names Created: 22/Oct/19  Updated: 06/Dec/22  Resolved: 05/Nov/19

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: None
Fix Version/s: None

Type: Task Priority: Major - P3
Reporter: Ian Boros Assignee: Backlog - Query Team (Inactive)
Resolution: Won't Fix Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Assigned Teams:
Query
Participants:

 Description   

In 4.2, $-prefixed field names were banned everywhere in agg.

In 4.4, there is a small whitelist of field names permitted to start with $.

 

If a user were to create a view, or a validator (and use $expr) with a $-prefixed field name in FCV 4.2, they may not be able to downgrade without dropping views/collections with a 4.4. binary.



 Comments   
Comment by Ian Boros [ 31/Oct/19 ]

I'm tempted to close this as "won't fix." This would be a relatively large amount of work for what I suspect is an unlikely case that only an "adversarial" user would find. Even if such a case happened, they could downgrade by using a 4.4 binary to drop the relevant view/collection. I'm not sure what our policy is on this kind of thing, however, so I'm flagging this for triage.

Generated at Thu Feb 08 05:05:11 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.