[SERVER-60572] Namespace string is not being parsed correctly Created: 08/Oct/21  Updated: 29/Oct/23  Resolved: 18/Nov/21

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 5.2.0

Type: Bug Priority: Major - P3
Reporter: Vishnu Kaushik Assignee: Daniel Gomez Ferro
Resolution: Fixed Votes: 0
Labels: neweng
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: Execution Team 2021-11-29
Participants:
Linked BF Score: 4

 Description   

A collection with the full namespace "test.system.buckets.../qa" should be a valid namespace, since the collection name starts with a letter character ("system...").

However, it looks like we are doing some incorrect parsing that is leading us to think that the collection name is "../qa". This error is thrown for certain commands such as collStats, but isn't when we create a collection.

Please see comments for more information.



 Comments   
Comment by Githook User [ 17/Nov/21 ]

Author:

{'name': 'Daniel Gomez Ferro', 'email': 'daniel.gomezferro@mongodb.com'}

Message: SERVER-60572 Validate collection name for system.buckets.* namespaces
Branch: master
https://github.com/mongodb/mongo/commit/3969d6d83bf0199a9a03215d24fe9d8ae585eff3

Comment by Daniel Gomez Ferro [ 15/Nov/21 ]

"<database>.system." is a special prefix where we store system information, and creating collections that begin with "system" is discouraged/forbidden: https://docs.mongodb.com/manual/reference/system-collections/ . That's why

db.createCollection("system.hello..no")

fails.

"system.buckets." is the prefix for timeseries buckets, and namespaces with that prefix are allowed in general, that's why both

db.createCollection("system.buckets.../qa")
db.createCollection("system.buckets..no")

work.

However when running "collStats" or "drop" we end up in NamespaceString::getTimeseriesViewNamespace. This function creates a NamespaceString object by stripping "system.buckets." from the namespace, resulting in a collection with name ".no" or "../qa", which are not legal and an error is raised.

My understanding is that we should prevent the creation of the collection in the first place, since it shouldn't be possible for users to pollute the "<database>.system.*" namespace, or at least we should make sure that <collection> in "<database>.system.bucket.<collection>" is a valid collection name (i.e. doesn't start with '.').

Comment by Kyle Suarez [ 11/Oct/21 ]

Interestingly, we ban the use of forward slash in database names, but not collection names: https://docs.mongodb.com/manual/reference/limits/#std-label-restrictions-on-db-names

Generated at Thu Feb 08 05:50:10 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.