GridFS data deletion via operator-document injection in file IDs

Impact

In GridFS delete methods, the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Patches

Upgrade to Go Driver v2.9.1 / v1.17.10 or later.

Workarounds

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

``` go

func exactMatch(id any) bson.D {

return bson.D{{"$eq", id}}

}

// e.g., for v1, (*Bucket).DeleteContext() with an exact match on the file ID.

bucket.DeleteContext(context.TODO(), exactMatch(id))

// e.g., for v2, (*GridFSBucket).Delete() with an exact match on the file ID.

gridFSBucket.Delete(context.TODO(), exactMatch(id))

`

References

[GODRIVER-4081](https://jira.mongodb.org/browse/GODRIVER-4081)