1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
/**
* Positive tests for the behavior of --enableJavaScriptProtection (the flag).
*
* Ensure that:
* 1. Simple functions stored in documents are not automatically marshalled
* when the flag is on in the shell.
* 2. $where is unable to use stored functions when the flag is set on the
* server.
* 3. db.loadServerScripts performs as expected even with the flag is set in
* the shell.
*/
(function() {
"use strict";
var testServer = MongoRunner.runMongod({setParameter: 'javascriptProtection=true'});
var db = testServer.getDB("test");
var t = db.foo;
var funcToStore = function(x) { return x + 1; };
function assertMongoClientCorrect() {
var mongo = runMongoProgram("mongo",
"--port", testServer.port,
"--enableJavaScriptProtection",
"--eval",
// stored functions in objects
"var x = db.foo.findOne({'_id' : 0});" +
"assert.neq(typeof x.foo, 'function');" +
// retain db.loadServerScripts() functionality
"db.loadServerScripts();" +
"assert.eq(stored_func(4), 5);" +
"print(\"completed gracefully\");"
);
var mongoOutput = rawMongoProgramOutput();
assert(!mongoOutput.match(/assert failed/));
assert(mongoOutput.match(/completed gracefully/));
}
function assertNoStoredWhere() {
t.insertOne({name: 'testdoc', val : 0, y : 0});
t.update( { $where : "stored_func(this.val) == 1" },
{ $set : { y : 100 } } , false , true );
var x = t.findOne({name: 'testdoc'});
assert.eq(x.y, 0);
t.update( { $where : function() { return this.val == 0;} } ,
{ $set : { y : 100 } } , false , true );
x = t.findOne({name: 'testdoc'});
assert.eq(x.y, 100);
}
/**
* ACTUAL TEST
*/
db.system.js.save( { _id : "stored_func" , value : funcToStore } );
t.insertOne({'_id': 0, 'myFunc': function() { return 'tesval'; } });
assertMongoClientCorrect();
assertNoStoredWhere();
MongoRunner.stopMongod(testServer);
})();
|
