Package: src:mongo-c-driver
Version: 1.30.4-1+deb13u3
Severity: grave
Tags: security patch
X-Debbugs-Cc: [email protected]
Dear Maintainer,
debian/patches/0009_CVE-2026-81524.patch (the backport of upstream
CDRIVER-6424, "validate db and collection names") breaks
mongoc_collection_aggregate() for every collection. It always returns a
cursor in the error state:
database name "<db>.<collection>" invalid: contains "."
== Cause ==
The patch adds a "db" parameter to _mongoc_aggregate(), but declares it in a
different position than it defines it.
mongoc-aggregate-private.h (declaration):
_mongoc_aggregate (mongoc_client_t *client,
const char *ns,
const char *db,
mongoc_query_flags_t flags, ...
mongoc-aggregate.c (definition):
_mongoc_aggregate (mongoc_client_t *client,
const char *db,
const char *ns,
mongoc_query_flags_t flags, ...
The callers follow the declaration, for example in mongoc-collection.c:
return _mongoc_aggregate (collection->client,
collection->ns,
collection->db,
flags, ...
Inside the function, "db" therefore holds collection->ns ("mydb.mycoll") and
"ns" holds collection->db. The new check
if (!_mongoc_cursor_check_db_name(cursor, db))
rejects the joined namespace because it contains ".".
Upstream 2.5.1 has the parameters in the same order in the declaration and
the definition (ns, db), so it is not affected. mongoc_database_aggregate()
passes db->name for both arguments, so it works by accident.
== Reproducer ==
#include <mongoc/mongoc.h> /* <mongoc.h> on 1.x */
#include <stdio.h>
int main(void) {
bson_error_t e; mongoc_init();
mongoc_client_t *c = mongoc_client_new("mongodb://127.0.0.1:27017/");
mongoc_collection_t *col = mongoc_client_get_collection(c, "testdb",
"coll");
bson_t *p = bson_new(); /* empty pipeline */
mongoc_cursor_t *cur = mongoc_collection_aggregate(col,
MONGOC_QUERY_NONE, p, NULL, NULL);
const bson_t *d;
while (mongoc_cursor_next(cur, &d)) {}
if (mongoc_cursor_error(cur, &e)) printf("error: %s\n", e.message);
return 0;
}
Expected: no error.
Actual: error: database name "testdb.coll" invalid: contains "."
(The error is set at cursor creation, before any server I/O, so it also
reproduces without a reachable server.)
== Impact ==
Any application that uses mongoc_collection_aggregate() cannot read from
MongoDB with this package. Discovered through the mongo_fdw foreign data
wrapper, whose reads all use aggregate, so its regression tests failed.
== Suggested fix ==
Make the definition match the declaration, in
src/libmongoc/src/mongoc/mongoc-aggregate.c:
-_mongoc_aggregate (mongoc_client_t *client,
- const char *db,
- const char *ns,
+_mongoc_aggregate (mongoc_client_t *client,
+ const char *ns,
+ const char *db,
Please also add a regression test that runs mongoc_collection_aggregate()
on a collection.
Regards,
--
*Jeevan Chalke*
*Senior Principal Engineer, Engineering Manager*
*Product Development*
enterprisedb.com <https://www.enterprisedb.com>
