SERVER-31248: Use of UUID in command requires privilege

1 files changed, 29 insertions, 0 deletions

diff --git a/src/mongo/db/auth/authorization_session_test.cpp b/src/mongo/db/auth/authorization_session_test.cpp
index 308156c31ee..0ec66e94598 100644
--- a/src/mongo/db/auth/authorization_session_test.cpp
+++ b/src/mongo/db/auth/authorization_session_test.cpp
@@ -1278,5 +1278,34 @@ TEST_F(AuthorizationSessionTest, CanListCollectionsWithListCollectionsPrivilege)
     ASSERT_TRUE(authzSession->isAuthorizedToListCollections(testQuxNss.db()));
 }
 
+TEST_F(AuthorizationSessionTest, CanUseUUIDNamespacesWithPrivilege) {
+    BSONObj stringObj = BSON("a"
+                             << "string");
+    BSONObj uuidObj = BSON("a" << UUID::gen());
+    BSONObj invalidObj = BSON("a" << 12);
+
+    // Strings require no privileges
+    ASSERT_TRUE(authzSession->isAuthorizedToParseNamespaceElement(stringObj.firstElement()));
+
+    // UUIDs cannot be parsed with default privileges
+    ASSERT_FALSE(authzSession->isAuthorizedToParseNamespaceElement(uuidObj.firstElement()));
+
+    // Element must be either a string, or a UUID
+    ASSERT_THROWS_CODE(authzSession->isAuthorizedToParseNamespaceElement(invalidObj.firstElement()),
+                       AssertionException,
+                       ErrorCodes::InvalidNamespace);
+
+    // The useUUID privilege allows UUIDs to be parsed
+    authzSession->assumePrivilegesForDB(
+        Privilege(ResourcePattern::forClusterResource(), {ActionType::useUUID}));
+
+    ASSERT_TRUE(authzSession->isAuthorizedToParseNamespaceElement(stringObj.firstElement()));
+    ASSERT_TRUE(authzSession->isAuthorizedToParseNamespaceElement(uuidObj.firstElement()));
+    ASSERT_THROWS_CODE(authzSession->isAuthorizedToParseNamespaceElement(invalidObj.firstElement()),
+                       AssertionException,
+                       ErrorCodes::InvalidNamespace);
+}
+
+
 }  // namespace
 }  // namespace mongo