SERVER-7005 reject embedded null bytes in $rename

2 files changed, 32 insertions, 0 deletions

diff --git a/src/mongo/db/ops/modifier_rename.cpp b/src/mongo/db/ops/modifier_rename.cpp
index 38555546a70..26dc2b23df9 100644
--- a/src/mongo/db/ops/modifier_rename.cpp
+++ b/src/mongo/db/ops/modifier_rename.cpp
@@ -74,6 +74,11 @@ Status ModifierRename::init(const BSONElement& modExpr, const Options& opts, boo
                       str::stream() << "The 'to' field for $rename must be a string: " << modExpr);
     }
 
+    if (modExpr.valueStringData().find('\0') != std::string::npos) {
+        return Status(ErrorCodes::BadValue,
+                      "The 'to' field for $rename cannot contain an embedded null byte");
+    }
+
     // Extract the field names from the mod expression
 
     _fromFieldRef.parse(modExpr.fieldName());
diff --git a/src/mongo/db/ops/modifier_rename_test.cpp b/src/mongo/db/ops/modifier_rename_test.cpp
index 0dfcb598f7f..fe37b27a31e 100644
--- a/src/mongo/db/ops/modifier_rename_test.cpp
+++ b/src/mongo/db/ops/modifier_rename_test.cpp
@@ -108,6 +108,33 @@ TEST(InvalidInit, FromDbTests) {
         mod.init(fromjson("{'b':'a.'}").firstElement(), ModifierInterface::Options::normal()));
 }
 
+TEST(InvalidInit, ToFieldCannotContainEmbeddedNullByte) {
+    ModifierRename mod;
+    {
+        StringData embeddedNull("a\0b", StringData::LiteralTag());
+        ASSERT_NOT_OK(mod.init(BSON("a" << embeddedNull).firstElement(),
+                               ModifierInterface::Options::normal()));
+    }
+
+    {
+        StringData singleNullByte("\0", StringData::LiteralTag());
+        ASSERT_NOT_OK(mod.init(BSON("a" << singleNullByte).firstElement(),
+                               ModifierInterface::Options::normal()));
+    }
+
+    {
+        StringData leadingNullByte("\0bbbb", StringData::LiteralTag());
+        ASSERT_NOT_OK(mod.init(BSON("a" << leadingNullByte).firstElement(),
+                               ModifierInterface::Options::normal()));
+    }
+
+    {
+        StringData trailingNullByte("bbbb\0", StringData::LiteralTag());
+        ASSERT_NOT_OK(mod.init(BSON("a" << trailingNullByte).firstElement(),
+                               ModifierInterface::Options::normal()));
+    }
+}
+
 TEST(MissingFrom, InitPrepLog) {
     Document doc(fromjson("{a: 2}"));
     Mod setMod(fromjson("{$rename: {'b':'a'}}"));