Operational Defect Database

BugZero found this defect 2527 days ago.

MongoDB | 367501

[SERVER-28473] --noscripting option on mongod doesn't work

Last update date:

5/31/2017

Affected products:

MongoDB Server

Affected releases:

3.5.4

Fixed releases:

No fixed releases provided.

Description:

Info

As per documentation at: https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-execution-of-javascript --noscripting option when passed to mongod, doesn't stop any '$where' executions.

Top User Comments

krishna.devale commented on Sat, 25 Mar 2017 11:08:34 +0000: Hi Mark, Thanks for your response. The issue is on my side. I had an alias for mongod as 'mongod --dbpath <path>' On the alias when I use mongod --noscripting, mongod was not recognizing the option. Even config file is very particular about indentation. I am able to get the --noscripting feature to work now. Thanks, Krishna mark.agarunov commented on Fri, 24 Mar 2017 18:35:48 +0000: Hello krishna.devale, Thank you for the report. Unfortunately, we have not been able to reproduce this. With --noscripting passed to mongod I'm seeing: Marks-MacBook-Pro(mongod-3.5.4) test> db.test.find( {$where:function(){print("TEST"); return true;}} ); Error: error: { "ok": 0, "errmsg": "no globalScriptEngine in $where parsing", "code": 2, "codeName": "BadValue", "operationTime": Timestamp(0, 0) } And no output in the server logs. Without --noscripting TEST is printed in the server logs. Thanks, Mark

Additional Resources / Links

Share:

BugZero Risk Score

Coming soon

Status

Closed

Have you been affected by this bug?

cost-cta-background

Do you know how much operational outages are costing you?

Understand the cost to your business and how BugZero can help you reduce those costs.

Discussion

Login to read and write comments.

Have you ever...

had your data corrupted from a

VMware

bug?

Search:

...