disable mongodb javascript

[Kapil Thangavelu]

we're not using mongodb server side evaluation of javascript, it would be sensible to disable it to avoid the attack surface area. ie pass --noscripting on the cli or via config.b

[Dave Cheney (dave-cheney)]

Probably useful as the javascript interpreter was the first thing to
break during the 1.10 load testing.

On Sat, Oct 19, 2013 at 5:32 AM, Kapil Thangavelu
<email address hidden> wrote:
> Public bug reported:
>
> we're not using mongodb server side evaluation of javascript, it would
> be sensible to disable it to avoid the attack surface area. ie pass
> --noscripting on the cli or via config.b
>
> ** Affects: juju-core
> Importance: Undecided
> Status: New
>
> --
> You received this bug notification because you are subscribed to juju-
> core.
> Matching subscriptions: MOAR JUJU SPAM!
> https://bugs.launchpad.net/bugs/1241763
>
> Title:
> disable mongodb javascript
>
> Status in juju-core:
> New
>
> Bug description:
> we're not using mongodb server side evaluation of javascript, it would
> be sensible to disable it to avoid the attack surface area. ie pass
> --noscripting on the cli or via config.b
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/juju-core/+bug/1241763/+subscriptions

[Curtis Hovey (sinzui)]

Fixing this will implicitly fix a cluster of charm bugs caused by libv8 in the cloud-archive.

[Anastasia (anastasia-macmood)]

Re-targeting for Juju 2.x

[Curtis Hovey (sinzui)]

This might be fixed. The juju-mongo packages do not have JS enabled for the client. The 3.2 server requires it to run wiredtiger.

[Anastasia (anastasia-macmood)]

Marking this as Fix Committed based on the comment # 4.

Feel free to re-open if you know otherwise and provide relevant information.