From 88bb77ec472281751c39bd981d1680df0e177bc3 Mon Sep 17 00:00:00 2001
From: Matt Broadstone <mbroadst@gmail.com>
Date: Tue, 18 Jun 2019 11:36:09 -0400
Subject: [PATCH] fix: validate atomic operations in all update methods

We were only validating update operations for atomic operators in
the non-pipelined case for `updateMany` and `findOneAndUpdate`.

Fixes NODE-1920
---
 lib/collection.js                | 10 +---------
 lib/operations/collection_ops.js |  7 +++++--
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/lib/collection.js b/lib/collection.js
index 9343c7f74d..9a692225e2 100644
--- a/lib/collection.js
+++ b/lib/collection.js
@@ -689,15 +689,7 @@ Collection.prototype.updateOne = function(filter, update, options, callback) {
   if (typeof options === 'function') (callback = options), (options = {});
   options = options || {};
 
-  let err;
-  if (Array.isArray(update)) {
-    for (let i = 0; !err && i < update.length; i++) {
-      err = checkForAtomicOperators(update[i]);
-    }
-  } else {
-    err = checkForAtomicOperators(update);
-  }
-
+  const err = checkForAtomicOperators(update);
   if (err) {
     if (typeof callback === 'function') return callback(err);
     return this.s.promiseLibrary.reject(err);
diff --git a/lib/operations/collection_ops.js b/lib/operations/collection_ops.js
index 6ab8d4435b..0339eda4ba 100644
--- a/lib/operations/collection_ops.js
+++ b/lib/operations/collection_ops.js
@@ -156,14 +156,17 @@ function bulkWrite(coll, operations, options, callback) {
 
 // Check the update operation to ensure it has atomic operators.
 function checkForAtomicOperators(update) {
-  const keys = Object.keys(update);
+  const keys = Array.isArray(update)
+    ? update.reduce((keys, u) => keys.concat(Object.keys(u)), [])
+    : Object.keys(update);
 
   // same errors as the server would give for update doc lacking atomic operators
   if (keys.length === 0) {
     return toError('The update operation document must contain at least one atomic operator.');
   }
 
-  if (keys[0][0] !== '$') {
+  const foundInvalid = keys.some(key => key[0] !== '$');
+  if (foundInvalid) {
     return toError('the update operation document must contain atomic operators.');
   }
 }