SERVER-103960 Impose a proper check on the FieldRef to ensure the num… (#41077)

GitOrigin-RevId: ec710de2238c59017c7f4875813f15c1ff588017

etc/backports_required_for_multiversion_tests.yml

@@ -625,6 +625,8 @@ last-continuous:
     ticket: SERVER-102477
   - test_file: jstests/sharding/query/union_with_doubly_nested_lookup.js
     ticket: SERVER-108341
+  - test_file: jstests/core/query/update/update_set_unset.js
+    ticket: SERVER-103960
   - test_file: jstests/core/txns/multi_statement_transaction_abort.js
     ticket: SERVER-84081
   - test_file: jstests/change_streams/ddl_create_drop_index_events.js
@@ -1308,6 +1310,8 @@ last-lts:
     ticket: SERVER-102477
   - test_file: jstests/sharding/query/union_with_doubly_nested_lookup.js
     ticket: SERVER-108341
+  - test_file: jstests/core/query/update/update_set_unset.js
+    ticket: SERVER-103960
   - test_file: jstests/core/txns/multi_statement_transaction_abort.js
     ticket: SERVER-84081
   - test_file: jstests/change_streams/ddl_create_drop_index_events.js

jstests/core/write/update/updatea.js

@@ -75,3 +75,11 @@ res = t.update({"c": 2}, {'$inc': {'a.c000': 1}});
 assert.commandWorked(res);
 
 assert.eq({"c00": 1, "c000": 1}, t.findOne().a, "D1");
+
+// SERVER-103960: Field paths cannot contain more than 255 dots.
+assert(t.drop());
+
+const longPath = '.'.repeat(256);
+
+assert.commandWorked(t.insertMany([{a: 1}, {b: 1}]));
+assert.commandFailedWithCode(t.update({a: 1}, {$set: {[longPath]: "y"}}), 10396001);

src/mongo/db/field_ref.cpp

@@ -108,6 +108,7 @@ void FieldRef::appendPart(StringData part) {
 
     _replacements.push_back(part.toString());
     _parts.push_back(boost::none);
+    uassert(10396002, "Field paths cannot contain more than 255 '.'", _parts.size() <= 255);
 }
 
 void FieldRef::removeLastPart() {
@@ -135,6 +136,7 @@ void FieldRef::removeFirstPart() {
 size_t FieldRef::appendParsedPart(FieldRef::StringView part) {
     _parts.push_back(part);
     _cachedSize++;
+    uassert(10396001, "Field paths cannot contain more than 255 '.'", _parts.size() <= 255);
     return _parts.size();
 }
 
@@ -172,7 +174,9 @@ void FieldRef::reserialize() const {
         // There is one case where we expect to see the "where" iterator to be at "end" here: we
         // are at the last part of the FieldRef and that part is the empty string. In that case, we
         // need to make sure we do not dereference the "where" iterator.
-        invariant(where != end || (size == 0 && i == parts - 1));
+        tassert(10396003,
+                "FieldRef was incorrectly dereferenced",
+                where != end || (size == 0 && i == parts - 1));
         if (!size) {
             part = StringView{};
         } else {

src/mongo/db/field_ref_test.cpp

@@ -444,6 +444,11 @@ TEST(AppendShort, SetEmptyPartThenAppend) {
     ASSERT_EQUALS("", path.getPart(1));
 }
 
+TEST(FieldRefTest, ContainsTooManyDots) {
+    std::string path(255, '.');
+    ASSERT_THROWS_CODE(FieldRef(path), AssertionException, 10396001);
+}
+
 // The "medium" append tests feature an append operation that spills out of reserve space (i.e.,
 // we append to a path that has _size == kReserveAhead).
 TEST(AppendMedium, Simple) {