SERVER-33858 Update and findAndModify with upsert=true should not create system.indexes collection

4 files changed, 34 insertions, 0 deletions

diff --git a/buildscripts/resmokeconfig/suites/sharded_causally_consistent_jscore_passthrough.yml b/buildscripts/resmokeconfig/suites/sharded_causally_consistent_jscore_passthrough.yml
index a6c3464b46a..42d31f308c8 100644
--- a/buildscripts/resmokeconfig/suites/sharded_causally_consistent_jscore_passthrough.yml
+++ b/buildscripts/resmokeconfig/suites/sharded_causally_consistent_jscore_passthrough.yml
@@ -51,6 +51,7 @@ selector:
   # The following tests fail because mongos behaves differently from mongod when testing certain
   # functionality. The differences are in a comment next to the failing test.
   - jstests/core/explain_missing_database.js  # Behavior with no db different on mongos, SERVER-18047.
+  - jstests/core/cannot_create_system_dot_indexes.js  # Insertion into system.indexes, SERVER-33890.
   - jstests/core/geo_2d_explain.js  # executionSuccess in different spot in explain().
   - jstests/core/geo_s2explain.js  # inputStage in different spot in explain().
   - jstests/core/geo_s2sparse.js  # keysPerIndex in different spot in validate().
diff --git a/jstests/core/cannot_create_system_dot_indexes.js b/jstests/core/cannot_create_system_dot_indexes.js
index c39ec6ae00b..6488a76702e 100644
--- a/jstests/core/cannot_create_system_dot_indexes.js
+++ b/jstests/core/cannot_create_system_dot_indexes.js
@@ -13,15 +13,46 @@
     // Cannot create system.indexes using the 'create' command.
     assert.commandFailedWithCode(db.createCollection("system.indexes"),
                                  ErrorCodes.InvalidNamespace);
+    assert.eq(
+        0, db.getCollectionInfos({name: "system.indexes"}).length, tojson(db.getCollectionInfos()));
 
     // Cannot create system.indexes using the 'renameCollection' command.
     db.coll.drop();
     assert.commandWorked(db.coll.insert({}));
     assert.commandFailed(db.coll.renameCollection("system.indexes"));
+    assert.eq(
+        0, db.getCollectionInfos({name: "system.indexes"}).length, tojson(db.getCollectionInfos()));
 
     // Cannot create system.indexes using the 'createIndexes' command.
     assert.commandFailedWithCode(db.system.indexes.createIndex({a: 1}),
                                  ErrorCodes.InvalidNamespace);
     assert.eq(
         0, db.getCollectionInfos({name: "system.indexes"}).length, tojson(db.getCollectionInfos()));
+
+    // Cannot create system.indexes using the 'insert' command.
+    assert.commandWorked(
+        db.system.indexes.insert({ns: "test.coll", v: 2, key: {a: 1}, name: "a_1"}));
+    assert.eq(
+        0, db.getCollectionInfos({name: "system.indexes"}).length, tojson(db.getCollectionInfos()));
+
+    // Cannot create system.indexes using the 'update' command with upsert=true.
+    assert.commandFailedWithCode(
+        db.system.indexes.update({ns: "test.coll", v: 2, key: {a: 1}, name: "a_1"},
+                                 {$set: {name: "a_1"}},
+                                 {upsert: true}),
+        ErrorCodes.InvalidNamespace);
+    assert.eq(
+        0, db.getCollectionInfos({name: "system.indexes"}).length, tojson(db.getCollectionInfos()));
+
+    // Cannot create system.indexes using the 'findAndModify' command with upsert=true.
+    let error = assert.throws(() => {
+        db.system.indexes.findAndModify({
+            query: {ns: "test.coll", v: 2, key: {a: 1}, name: "a_1"},
+            update: {$set: {name: "a_1"}},
+            upsert: true
+        });
+    });
+    assert.eq(error.code, ErrorCodes.InvalidNamespace);
+    assert.eq(
+        0, db.getCollectionInfos({name: "system.indexes"}).length, tojson(db.getCollectionInfos()));
 }());
diff --git a/src/mongo/db/commands/find_and_modify.cpp b/src/mongo/db/commands/find_and_modify.cpp
index 8a5fb7b256d..6c732d24f10 100644
--- a/src/mongo/db/commands/find_and_modify.cpp
+++ b/src/mongo/db/commands/find_and_modify.cpp
@@ -452,6 +452,7 @@ public:
 
                     // If someone else beat us to creating the collection, do nothing
                     if (!collection) {
+                        uassertStatusOK(userAllowedCreateNS(nsString.db(), nsString.coll()));
                         WriteUnitOfWork wuow(opCtx);
                         uassertStatusOK(
                             userCreateNS(opCtx, autoDb->getDb(), nsString.ns(), BSONObj()));
diff --git a/src/mongo/db/ops/write_ops_exec.cpp b/src/mongo/db/ops/write_ops_exec.cpp
index 3689cc9847d..59f49cd5024 100644
--- a/src/mongo/db/ops/write_ops_exec.cpp
+++ b/src/mongo/db/ops/write_ops_exec.cpp
@@ -193,6 +193,7 @@ void makeCollection(OperationContext* opCtx, const NamespaceString& ns) {
         AutoGetOrCreateDb db(opCtx, ns.db(), MODE_X);
         assertCanWrite_inlock(opCtx, ns);
         if (!db.getDb()->getCollection(opCtx, ns)) {  // someone else may have beat us to it.
+            uassertStatusOK(userAllowedCreateNS(ns.db(), ns.coll()));
             WriteUnitOfWork wuow(opCtx);
             uassertStatusOK(userCreateNS(opCtx, db.getDb(), ns.ns(), BSONObj()));
             wuow.commit();