[SERVER-62827] Prevent rpc::upconvertRequest from erroneously duplicating top-level $readPreference field in command object Created: 20/Jan/22  Updated: 29/Oct/23  Resolved: 14/Feb/22

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 5.3.0

Type: Bug Priority: Major - P3
Reporter: Blake Oler Assignee: Blake Oler
Resolution: Fixed Votes: 0
Labels: servicearch-wfbf-day
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Backwards Compatibility: Fully Compatible
Operating System: ALL
Steps To Reproduce:

(function() {
'use strict';
 
load("jstests/libs/override_methods/set_read_preference_secondary.js");
 
var st = new ShardingTest({shards: 2});
 
st.s0.getDB('db').runCommand({
    find: 'foo',
    $readPreference: {
        mode: 'nearest'
    },
});
 
st.stop();
})();

Sprint: Service Arch 2022-2-07, Service Arch 2022-2-21
Participants:
Linked BF Score: 64
Story Points: 3

 Description   

Scenario

On a debug build of a MongoDB cluster:

  1. A commandObj passed into runCommandWithReadPreferenceSecondary here has the $readPreference field specified at the top level.
  2. The commandObj is wrapped in a query object here, meaning that the original $readPreference object is now at the second level.
  3. The function checks here if the top level of the object has the $readPreference field (it does not).
  4. The function adds a $readPreference field – the BSONObj now has two $readPreference fields.
  5. rpc::upconvertRequest() adds the $readPreference field from the query object to the top level erroneously.
  6. The shell crashes when attempting to send the commandObj, because the $readPreference field was duplicated.

There's reason to believe this could also happen with an old driver sending OP_QUERY messages and specifying a readPreference on both the query object and the top-level, but I wasn't able to reproduce it easily.

Suggested fix

Throw ErrorCodes::InvalidOptions in rpc::upconvertRequest() if there is a $readPreference specified in both the query object and the top level.



 Comments   
Comment by Githook User [ 10/Feb/22 ]

Author:

{'name': 'Blake Oler', 'email': 'blake.oler@mongodb.com', 'username': 'BlakeIsBlake'}

Message: SERVER-62827 Prevent rpc::upconvertRequest from erroneously duplicating top-level $readPreference field in command object
Branch: master
https://github.com/mongodb/mongo/commit/482d143fdff542e67b7aa2a2d9e7c4468d1ecd28

Generated at Thu Feb 08 05:56:10 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.