SERVER-43287 Prevent from outputting to system collections

2 files changed, 12 insertions, 0 deletions

diff --git a/src/mongo/db/pipeline/document_source_merge.cpp b/src/mongo/db/pipeline/document_source_merge.cpp
index 119219b9e7b..a804dc921f9 100644
--- a/src/mongo/db/pipeline/document_source_merge.cpp
+++ b/src/mongo/db/pipeline/document_source_merge.cpp
@@ -377,6 +377,14 @@ boost::intrusive_ptr<DocumentSource> DocumentSourceMerge::create(
             "{} cannot be used with a 'linearizable' read concern level"_format(kStageName),
             readConcernLevel != repl::ReadConcernLevel::kLinearizableReadConcern);
 
+    uassert(31319,
+            "Cannot {} to special collection: {}"_format(kStageName, outputNs.coll()),
+            !outputNs.isSystem());
+
+    uassert(31320,
+            "Cannot {} to internal database: {}"_format(kStageName, outputNs.db()),
+            !outputNs.isOnInternalDb());
+
     if (whenMatched == WhenMatched::kPipeline) {
         if (!letVariables) {
             // For custom pipeline-style updates, default the 'let' variables to {new: "$$ROOT"},
diff --git a/src/mongo/db/pipeline/document_source_out.cpp b/src/mongo/db/pipeline/document_source_out.cpp
index 1208bcea38b..860d9028bec 100644
--- a/src/mongo/db/pipeline/document_source_out.cpp
+++ b/src/mongo/db/pipeline/document_source_out.cpp
@@ -199,6 +199,10 @@ boost::intrusive_ptr<DocumentSource> DocumentSourceOut::create(
             "Can't {} to special collection: {}"_format(kStageName, outputNs.coll()),
             !outputNs.isSystem());
 
+    uassert(31321,
+            "Can't {} to internal database: {}"_format(kStageName, outputNs.db()),
+            !outputNs.isOnInternalDb());
+
     return new DocumentSourceOut(std::move(outputNs), expCtx);
 }