[SERVER-8832] Prototype extensions get saved along with primitive data Created: 03/Mar/13  Updated: 11/Jul/16  Resolved: 05/Mar/13

Status: Closed
Project: Core Server
Component/s: JavaScript
Affects Version/s: 2.4.0-rc1
Fix Version/s: 2.4.0-rc2

Type: Bug Priority: Blocker - P1
Reporter: Andre Quina Assignee: Ben Becker
Resolution: Done Votes: 0
Labels: javascript
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

OSX


Operating System: ALL
Steps To Reproduce:

db.system.js.save({_id: "extendArray", value: function () { Array.prototype.fancyArrayFunction = function()

{ return 'do something'; }

; }});
db.records.insert(

{foo_id: 1, values:[1,2]}

)
var mapFunction1 = function()

{extendArray(); emit(this.foo_id, this.values); }

;
var reduceFunction1 = function(key, values)

{return values;}

;
db.records.mapReduce(mapFunction1, reduceFunction1,

{ out: "map_reduce_example" }

);

db.map_reduce_example.find({})[0]['value']

[
function _cf9f_anonymous_function() {
return "do something";
},
2

Notice that we have 2 elements in the array as we should, but one of the 2 is the function. If I mongoexport the collection I see all three elements, so the console seems to be having an issue with the length of the array on this also.

./mongoexport --jsonArray -d test3 -c map_reduce_example

connected to: 127.0.0.1
[{ "_id" : 1, "value" : [ 1, 2, function ()

{return "do something";}

] }]
exported 1 records

Participants:

 Description   

Running the 3/1 nightly build. Builds before that one do not allow calling functions from system.js

It appears that functions extending the javascript Array class get added to the array when it gets stored.



 Comments   
Comment by auto [ 05/Mar/13 ]

Author:

{u'date': u'2013-03-05T17:11:26Z', u'name': u'Ben Becker', u'email': u'ben.becker@10gen.com'}

Message: SERVER-8832: do not convert javascript properties in prototype chain
Branch: master
https://github.com/mongodb/mongo/commit/f4cf69ce489dd7ea90214dda4d799e3f7a294c35

Comment by Andre Quina [ 05/Mar/13 ]

Thanks for the fix. I'll review against our application once it's in the nightly or the next RC.

Comment by Ben Becker [ 05/Mar/13 ]

Hi Andre,

Just wanted to say thank you for the bug report. I went ahead and submitted a fix for review.

> db.system.js.save({_id: "extendArray", value: function () { Array.prototype.fancyArrayFunction = function() { return 'do something'; }; }});
> db.records.insert({foo_id: 1, values:[1,2]})
> var mapFunction1 = function() {extendArray(); emit(this.foo_id, this.values); };
> var reduceFunction1 = function(key, values){return values;};
> db.records.mapReduce(mapFunction1, reduceFunction1, { out: "map_reduce_example" } );
{
	"result" : "map_reduce_example",
	"timeMillis" : 251,
	"counts" : {
		"input" : 1,
		"emit" : 1,
		"reduce" : 0,
		"output" : 1
	},
	"ok" : 1,
}
> db.map_reduce_example.find({})[0]['value']
[ 1, 2 ]
> ^C
bye
$ ./mongoexport -d test -c map_reduce_example
connected to: 127.0.0.1
{ "_id" : 1, "value" : [ 1, 2 ] }
exported 1 records

Regards,
-ben

Comment by Ben Becker [ 05/Mar/13 ]

The same issue exists for string values, and types.js adds new prototypes.

Comment by Andre Quina [ 03/Mar/13 ]

This behaves properly in 2.2.0

Generated at Thu Feb 08 03:18:35 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.