SERVER-34040 Disallow $changeStream on internal databases and system collections

2 files changed, 16 insertions, 0 deletions

diff --git a/src/mongo/db/namespace_string.h b/src/mongo/db/namespace_string.h
index a8fac0a2a58..3e5a0d07793 100644
--- a/src/mongo/db/namespace_string.h
+++ b/src/mongo/db/namespace_string.h
@@ -212,6 +212,9 @@ public:
     bool isSystem() const {
         return coll().startsWith("system.");
     }
+    bool isAdminDB() const {
+        return db() == kAdminDb;
+    }
     bool isLocal() const {
         return db() == kLocalDb;
     }
diff --git a/src/mongo/db/pipeline/document_source_change_stream.cpp b/src/mongo/db/pipeline/document_source_change_stream.cpp
index 6ce6740cc4d..b13ce05cd2d 100644
--- a/src/mongo/db/pipeline/document_source_change_stream.cpp
+++ b/src/mongo/db/pipeline/document_source_change_stream.cpp
@@ -334,6 +334,19 @@ list<intrusive_ptr<DocumentSource>> DocumentSourceChangeStream::createFromBson(
     intrusive_ptr<DocumentSource> resumeStage = nullptr;
     auto spec = DocumentSourceChangeStreamSpec::parse(IDLParserErrorContext("$changeStream"),
                                                       elem.embeddedObject());
+
+    // TODO SERVER-34086: $changeStream may run against the 'admin' database iff
+    // 'allChangesForCluster' is true.
+    uassert(ErrorCodes::InvalidNamespace,
+            str::stream() << "$changeStream may not be opened on the internal " << expCtx->ns.db()
+                          << " database",
+            !(expCtx->ns.isAdminDB() || expCtx->ns.isLocal() || expCtx->ns.isConfigDB()));
+
+    uassert(ErrorCodes::InvalidNamespace,
+            str::stream() << "$changeStream may not be opened on the internal " << expCtx->ns.ns()
+                          << " collection",
+            !expCtx->ns.isSystem());
+
     if (auto resumeAfter = spec.getResumeAfter()) {
         ResumeToken token = resumeAfter.get();
         ResumeTokenData tokenData = token.getData();