--noscripting not preventing scripting

Question

I've started my MongoDB server with the --noscripting option:

mongod --dbpath C:\MongoData --noscripting

However, I can still load JavaScript files and execute the code in them:

> load('/Users/d.banks/Documents/mongo-rocks/hello-world.js')
true
> Hello('Dave')
Hello Dave!

I assume that the script is running because it's client-side? If that's the case, what determines if a script is client or server side? If not, why is the script running?

glytching · Accepted Answer · 2018-01-16 16:06:10Z

1

This ...

load('/Users/d.banks/Documents/mongo-rocks/hello-world.js')

... is an example of client-side scripting. It is client-side because it runs in the client.

The startup option --noscripting disables server-side scripting i.e. Javascript which runs on the server. Examples of this include

$where: the $where is a JavaScript expression or function which is executed server-side
$group: the $reduce, $keyf and finalize parameters are Javascript functions which are executed server-side
$mapreduce: the map and reduce parameters are Javascript functions which are executed server-side

So, in summary --noscripting disables server-side scripting, it has no effect on client-side scripting. Server-side scripta are those which execute on the server, with the three listed above being the prime examples.

answered Jan 16, 2018 at 16:06

glytching

48.5k11 gold badges127 silver badges129 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

BanksySan Over a year ago

Is it client-side because it runs in the client or does it run in the client because it's client-side? Mind has just blown.

BanksySan Over a year ago

However, it's the methods the script uses that will determine where it's executed? Is there no way to force a script to run on the server?

glytching Over a year ago

There's nothing inherently client (or server) side about any Javascript expression or function. The client (or server) sided-ness is an aspect of where it is run. So, when you load a JS file into your client (as you showed in your question) then that is run server side but when you pass a Javascript function to the server (as you can do when using $where, $group or $mapreduce) then you are asking the server to run that on your behalf and that is, therefore, server-side Javascript.

glytching Over a year ago

In answer to this: "Is there no way to force a script to run on the server?" ... in order for the server to run the script you need some way to pass it to the server and $where / $group / $mapreduce all expose parameteers which allow you to pass JS to the server. Once passed to the server, this JS will be executed on the server. However, this: load('/Users/d.banks/Documents/mongo-rocks/hello-world.js'); is not passed to the server and it will only ever be invoked client side.

Collectives™ on Stack Overflow

--noscripting not preventing scripting

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related