SERVER-7005 reject embedded null bytes in $rename

Manually cherry-picked from 75f24a26015

2 files changed, 33 insertions, 0 deletions

diff --git a/src/mongo/db/ops/modifier_rename.cpp b/src/mongo/db/ops/modifier_rename.cpp
index 3942d11cea7..79ecce73095 100644
--- a/src/mongo/db/ops/modifier_rename.cpp
+++ b/src/mongo/db/ops/modifier_rename.cpp
@@ -84,6 +84,12 @@ namespace mongo {
                                         << modExpr);
         }
 
+        StringData valueStringData(modExpr.valuestr(), modExpr.valuestrsize() - 1);
+        if (valueStringData.find('\0') != std::string::npos) {
+            return Status(ErrorCodes::BadValue,
+                          "The 'to' field for $rename cannot contain an embedded null byte");
+        }
+
         // Extract the field names from the mod expression
 
         _fromFieldRef.parse(modExpr.fieldName());
diff --git a/src/mongo/db/ops/modifier_rename_test.cpp b/src/mongo/db/ops/modifier_rename_test.cpp
index 6d889bb9c58..37b1a6f2df0 100644
--- a/src/mongo/db/ops/modifier_rename_test.cpp
+++ b/src/mongo/db/ops/modifier_rename_test.cpp
@@ -107,6 +107,33 @@ namespace {
                                ModifierInterface::Options::normal()));
     }
 
+    TEST(InvalidInit, ToFieldCannotContainEmbeddedNullByte) {
+        ModifierRename mod;
+        {
+            StringData embeddedNull("a\0b", StringData::LiteralTag());
+            ASSERT_NOT_OK(mod.init(BSON("a" << embeddedNull).firstElement(),
+                                   ModifierInterface::Options::normal()));
+        }
+
+        {
+            StringData singleNullByte("\0", StringData::LiteralTag());
+            ASSERT_NOT_OK(mod.init(BSON("a" << singleNullByte).firstElement(),
+                                   ModifierInterface::Options::normal()));
+        }
+
+        {
+            StringData leadingNullByte("\0bbbb", StringData::LiteralTag());
+            ASSERT_NOT_OK(mod.init(BSON("a" << leadingNullByte).firstElement(),
+                                   ModifierInterface::Options::normal()));
+        }
+
+        {
+            StringData trailingNullByte("bbbb\0", StringData::LiteralTag());
+            ASSERT_NOT_OK(mod.init(BSON("a" << trailingNullByte).firstElement(),
+                                   ModifierInterface::Options::normal()));
+        }
+    }
+
     TEST(MissingFrom, InitPrepLog) {
         Document doc(fromjson("{a: 2}"));
         Mod setMod(fromjson("{$rename: {'b':'a'}}"));