Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite

Impact

When calling [Client.BulkWrite](https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.1/mongo#Client.BulkWrite), a caller-controlled database name containing period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

Patches

Upgrade to Go Driver v2.8.2 or later.

Workarounds

Users can manually validate database and collection names before calling [Client.BulkWrite](https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.1/mongo#Client.BulkWrite) using code like the following.

```go

func validateBulkWrites(writes []mongo.ClientBulkWrite) error {

for i, w := range writes {

if strings.ContainsRune(w.Database, '.') {

return fmt.Errorf(

"invalid database name %q in write %d: database names cannot contain '.'",

w.Database,

i,

)

}

}

return nil

}

`

References

• [GODRIVER-4075](https://jira.mongodb.org/browse/GODRIVER-4075)
• https://github.com/mongodb/mongo-go-driver/blob/v2.8.1/mongo/client.go#L954-L964