#9725: Program does not add type checking when builds $where

slavakiev reported 2013-08-07T11:58:38Z · last modified 2013-09-02T16:14:13Z

Program does not add type checking when builds $where

Dev	emil.goicovici
QA	tariqrahiman

Priority	Low
Complexity	Unknown

Component	MongoSQL
Version	14.0

Tested Aqua Data Studio Aqua Data Studio 14.0.0-beta-79 Build #: 33402 on Ubuntu 12.04( Mongo DB 2.4.3) and Windows XP ( Mongo DB 2.0.9).

Program when builds $where statements uses simple equalence "==" instead strict "===" or does not include "typedef" for checking types of the fields and this gives wrong results.

See next scriptset and results:

drop collection jstype

insert into jstype(tnum,tname,var) values (1,'Double',1.0)

insert into jstype(tnum,tname,var) values (2,'String','1')

insert into jstype(tnum,tname,var) values (4,'Array',[1])

insert into jstype(tnum,tname,var) values (5,'Binary data',HEXDATA("01"))

insert into jstype(tnum,tname,var) values (7,'Object id',ObjectId('123456789012345678901234'))

insert into jstype(tnum,tname,var) values (8,'Boolean',true)

insert into jstype(tnum,tname,var) values (9,'Date',Date())

insert into jstype(tnum,tname,var) values (10,'Null',null)

insert into jstype(tnum,tname,var) values (16,'32bit integer',1)

insert into jstype(tnum,tname,var) values (17,'Time Stamp',BSONTimeStamp(1,1))

insert into jstype(tnum,tname,var) values (255,'MinKey',MinKey())

insert into jstype(tnum,tname,var) values (127,'MaxKey',MaxKey())

insert into jstype(tnum,tname) values (0,'Absent')

select tname,var from jstype where var+1>1

--tname var

------------ ------------------------

--Double 1

--String 1

--Array [ 1 ]

--Object id 123456789012345678901234

--Boolean true

--32bit integer 1

--program sends wrong $where

--(this.var+1>1)

--should be

--db.jstype.find({$where:"(this.var+1>1) && (typeof this.var=='number')"})

If more than one field are in the expression then necessary to use strict eqv "===" or eqv of typedef e.g. && (typeof this.a==typeof this.b)

All Comments (8) Change History

JennyNishimura 2013-08-12T17:17:35Z

Emil, please assess the impact of this change.

emil.goicovici 2013-08-14T19:36:27Z · (edited)

Using the changes made to fix issue #9747, I can append a && (typeof <<field>>=='number') suffix for each identifier encountered inside an arithmetic expression. This way we ensure that, for arithmetic expressions, only numeric values are taken into account while applying the $where filter.

I've tried this approach and didn't find any conflict / regression so far.

JennyNishimura 2013-08-14T19:59:26Z

OK, let's check in this fix.

slavakiev 2013-08-19T14:02:15Z

Tested Aqua Data Studio Aqua Data Studio 14.0.0-beta-85 Build #: 33590 on Ubuntu 12.04( Mongo DB 2.4.3) and Windows XP ( Mongo DB 2.0.9).

For bitwise operation necessary also add && (typeof <<field>>=='number')

See next result:

select tname,var from jstype where (var&1)=0

--tname --var

--Binary data 01

--Object id 123456789012345678901234

--Date 8/19/2013 5:04:30 PM

--Null (null)

--Time Stamp TS time:Thu Jan 01 02:00:01 EET 1970 inc:1

--MinKey MinKey

--MaxKey MaxKey

--Absent (null)

Because for types other than number it does not work. e.g Binary (01) & 1 should be 1 or Tiemstamp(1,1) & 1 =1 as it is 2 32bit fields with 1 value.

emil.goicovici 2013-08-20T17:46:08Z

The typeof <<field>>=='number' suffix is now appended for bitwise operations.

slavakiev 2013-08-26T15:14:15Z

Tested Aqua Data Studio Aqua Data Studio 14.0.0-rc-3 Build #: 33692 on Ubuntu 12.04( Mongo DB 2.4.3)

1. In same cases typeof 'number' is not added for all fields:

select tname,var from jstype where tnum/tnum =var

--tname var

--Double 1

--String 1

--Array [ 1 ]

--Boolean true

--32bit integer 1

--Program does not add typeof 'number' for var field

--(this['tnum'] / this['tnum']==this['var']) && (typeof this['tnum']=='number') && (typeof this['tnum']=='number')

2. As I mentioned for comparison of fields without expressions necessary to add equality of typeof's:

select tname,var from jstype where var=tname

--tname var

--Time Stamp TS time:Wed Dec 31 19:00:01 EST 1969 inc:1

--MinKey MinKey

--MaxKey MaxKey

--Program sends not complete $where

--this['var']<this['tname']

--Should be:

--db.jstype.find({$where:"(this['var']< this['tname'])&&(typeof this['var']==typeof this['tname']" })

emil.goicovici 2013-08-26T17:56:00Z

Fixed both scenarios.

2. As I mentioned for comparison of fields without expressions necessary to add equality of typeof's:

The WHERE field1 = field2 , WHERE field1 != field2 cases have been simplified by using strict equality javascript operators ( === resp. !== ). For the other cases, the equality of typeof's is now used.

slavakiev 2013-09-02T16:14:13Z

Verified in Aqua Data Studio Aqua Data Studio 14.0.0-rc-8 Build #: 33812 on Ubuntu 12.04( Mongo DB 2.4.3)

Search Tips

Aqua Data Studio / nhilam

Program does not add type checking when builds $where

Issue #9725

Completion

Search Tips

Aqua Data Studio / nhilam

Title

Program does not add type checking when builds $where

Issue #9725

Completion