The following issues were found

src/mongo/shell/bench.cpp
1 issues
Shifting by a negative value is undefined behaviour
Error

Line: 295 CWE codes: 758 

                  // Sort by descending 'ts' in the query to the oplog collection. The first entry will have the
    // latest cluster time.
    auto findCommand = std::make_unique<FindCommandRequest>(NamespaceString("local.oplog.rs"));
    findCommand->setSort(BSON("$natural" << -1));
    findCommand->setLimit(1LL);
    findCommand->setSingleBatch(true);
    invariant(query_request_helper::validateFindCommandRequest(*findCommand));
    const auto dbName =
        findCommand->getNamespaceOrUUID().nss().value_or(NamespaceString()).db().toString();

Reported by Cppcheck.

src/mongo/shell/kms_azure.cpp
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 182 Column: 23 CWE codes: 126 

              std::unique_ptr<uint8_t, decltype(std::free)*> AzureKMSService::makeRequest(
    kms_request_t* request, const HostAndPort& keyVaultEndpoint, size_t* raw_len) {
    auto buffer = UniqueKmsCharBuffer(kms_request_to_string(request));
    auto buffer_len = strlen(buffer.get());
    KMSNetworkConnection connection(_sslManager.get());
    auto response =
        connection.makeOneRequest(keyVaultEndpoint, ConstDataRange(buffer.get(), buffer_len));

    auto body = kms_response_get_body(response.get(), nullptr);

Reported by FlawFinder.

src/mongo/shell/kms_network.cpp
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 163 Column: 23 CWE codes: 126 

                  UniqueKmsRequest request = getOAuthRequest();

    auto buffer = UniqueKmsCharBuffer(kms_request_to_string(request.get()));
    auto buffer_len = strlen(buffer.get());

    KMSNetworkConnection connection(_sslManager.get());
    auto response =
        connection.makeOneRequest(_oAuthEndpoint, ConstDataRange(buffer.get(), buffer_len));

Reported by FlawFinder.

src/mongo/shell/kms_test.cpp
1 issues
syntax error
Error

Line: 49 

              

// Negative: incorrect key size
TEST(KmsTest, TestBadKey) {
    std::array<uint8_t, 3> key{0x1, 0x2, 0x3};
    BSONObj config =
        BSON("local" << BSON("key" << BSONBinData(key.data(), key.size(), BinDataGeneral)));

    ASSERT_THROWS(KMSServiceController::createFromClient("local", config), AssertionException);

Reported by Cppcheck.

src/mongo/shell/shell_options_storage.cpp
1 issues
strncpy - Easily used incorrectly; doesn't always \0-terminate or check for invalid pointers [MS-banned]
Security

Line: 46 Column: 15 CWE codes: 120 

                      StringData arg(argv[i]);
        if (MongoURI::isMongoURI(arg)) {
            auto reformedURI = MongoURI::redact(arg);
            ::strncpy(argv[i], reformedURI.data(), arg.size());
        }
    }
}

Reported by FlawFinder.

src/mongo/shell/shell_options_test.cpp
1 issues
strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 79 Column: 32 CWE codes: 126 

                      redactPasswordOptions(argv.size(), &argv.front());
        for (size_t i = 0; i < testCase.first.size(); i++) {
            auto shrunkArg = testCase.first[i];
            shrunkArg.resize(::strlen(shrunkArg.c_str()));
            ASSERT_EQ(shrunkArg, testCase.second[i]);
        }
    }
}
}  // namespace

Reported by FlawFinder.

src/mongo/shell/shell_utils.cpp
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 78 Column: 26 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

              
    return "./";
#else
    const auto homeDir = getenv("HOME");
    if (homeDir)
        return homeDir;

    // The storage for these variables has to live until the value is captured into a std::string at
    // the end of this function.  This is because getpwuid_r(3) doesn't use static storage, but

Reported by FlawFinder.

src/mongo/stdx/unordered_map_test.cpp
1 issues
syntax error
Error

Line: 58 

                  return r;
}

TEST(StdxUnorderedMapTest, atShouldThrow) {
    mongo::stdx::unordered_map<int, int> m;
    ASSERT_THROWS(m.at(42), std::out_of_range);
}

TEST(StdxUnorderedMapTest, EraseIf) {

Reported by Cppcheck.

src/mongo/transport/max_conns_override_test.cpp
1 issues
syntax error
Error

Line: 70 

              }
#endif

TEST(MaxConnsOverride, NormalCIDR) {
    ExemptionVector cidrOnly{makeExemption("127.0.0.1"), makeExemption("10.0.0.0/24")};

    ASSERT_TRUE(shouldOverrideMaxConns(makeIPSession("127.0.0.1"), cidrOnly));
    ASSERT_TRUE(shouldOverrideMaxConns(makeIPSession("10.0.0.35"), cidrOnly));
    ASSERT_FALSE(shouldOverrideMaxConns(makeIPSession("192.168.0.53"), cidrOnly));

Reported by Cppcheck.

src/mongo/transport/message_compressor_registry_test.cpp
1 issues
syntax error
Error

Line: 68 

                  ASSERT_NULL(registry.getCompressor(255));
}

TEST(MessageCompressorRegistry, NothingRegistered) {
    MessageCompressorRegistry registry;

    ASSERT_NULL(registry.getCompressor("noop"));
    ASSERT_NULL(registry.getCompressor(0));
}

Reported by Cppcheck.