SERVER-51615 Disallow writes to system.js collection with apiStrict:true

1 files changed, 77 insertions, 1 deletions

diff --git a/jstests/core/api_version_parameters.js b/jstests/core/api_version_parameters.js
index c81f2decb19..e370037b26f 100644
--- a/jstests/core/api_version_parameters.js
+++ b/jstests/core/api_version_parameters.js
@@ -1,7 +1,10 @@
 /**
  * Checks that the server properly parses "API Version" parameters
  *
- * @tags: [requires_fcv_47]
+ * @tags: [
+ *  requires_fcv_47,
+ *  uses_api_parameters,
+ * ]
  */
 
 (function() {
@@ -65,4 +68,77 @@ assert.commandFailedWithCode(
     db.runCommand({testDeprecation: 1, apiVersion: "1", apiDeprecationErrors: true}),
     ErrorCodes.APIDeprecationError,
     "Provided apiDeprecationErrors: true, but the invoked command's deprecatedApiVersions() does not include \"1\"");
+
+// Test writing to system.js fails.
+assert.commandFailedWithCode(
+    db.runCommand({
+        insert: "system.js",
+        documents: [{
+            _id: "shouldntExist",
+            value: function() {
+                return 1;
+            }
+        }],
+        apiVersion: "1",
+        apiStrict: true
+    }),
+    ErrorCodes.APIStrictError,
+    "Provided apiStrict:true, but the command insert attempts to write to system.js");
+assert.commandFailedWithCode(
+    db.runCommand({
+        update: "system.js",
+        updates: [{
+            q: {
+                _id: "shouldExist",
+                value: function() {
+                    return 1;
+                }
+            },
+            u: {
+                _id: "shouldExist",
+                value: function() {
+                    return 2;
+                }
+            }
+        }],
+        apiVersion: "1",
+        apiStrict: true
+    }),
+    ErrorCodes.APIStrictError,
+    "Provided apiStrict:true, but the command update attempts to write to system.js");
+assert.commandFailedWithCode(
+    db.runCommand({
+        delete: "system.js",
+        deletes: [{
+            q: {
+                _id: "shouldExist",
+                value: function() {
+                    return 1;
+                }
+            },
+            limit: 1
+        }],
+        apiVersion: "1",
+        apiStrict: true
+    }),
+    ErrorCodes.APIStrictError,
+    "Provided apiStrict:true, but the command delete attempts to write to system.js");
+assert.commandFailedWithCode(
+    db.runCommand({
+        findAndModify: "system.js",
+        query: {
+            _id: "shouldExist",
+            value: function() {
+                return 1;
+            }
+        },
+        delete: true,
+        apiVersion: "1",
+        apiStrict: true
+    }),
+    ErrorCodes.APIStrictError,
+    "Provided apiStrict:true, but the command findAndModify attempts to write to system.js");
+// Test reading from system.js succeeds.
+assert.commandWorked(db.runCommand(
+    {find: "system.js", filter: {_id: "shouldExist"}, apiVersion: "1", apiStrict: true}));
 })();