Skip to content

Commit 16cdf44

Browse files
ksadoffksadoff
committed
CSHARP-2291: Allow unencoded subdelimiters in usernames and passwords
1 parent ceb1efa commit 16cdf44

File tree

14 files changed

+335
-98
lines changed

14 files changed

+335
-98
lines changed

‎src/MongoDB.Driver.Core/Core/Configuration/ConnectionString.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -756,7 +756,7 @@ private void Parse()
756756
const string optionsPattern = @"(\?" + optionPattern + @"((&|;)" + optionPattern + ")*)?";
757757
const string pattern =
758758
@"^(?<scheme>mongodb|mongodb\+srv)://" +
759-
@"((?<username>[^:@]+)(:(?<password>[^:@]*))?@)?" +
759+
@"((?<username>[^:@/]+)(:(?<password>[^:@/]*))?@)?" +
760760
serversPattern + @"(/" + databasePattern + ")?/?" + optionsPattern + "$";
761761

762762
if (_originalConnectionString.Contains("%"))

‎tests/MongoDB.Driver.Core.Tests/Specifications/connection-string/tests/README.rst‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,3 +97,7 @@ handler and watching for output).
9797

9898
Not all drivers may be able to directly assert the hosts, auth credentials, and
9999
options. Doing so may require exposing the driver's URI parsing component.
100+
101+
The file valid-db-with-dotted-name.yml is a special case for testing drivers
102+
that allow dotted namespaces, instead of only database names, in the Auth
103+
Database portion of the URI.

‎tests/MongoDB.Driver.Core.Tests/Specifications/connection-string/tests/invalid-uris.json‎

Lines changed: 47 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,34 @@
206206
"uri": "mongodb://alice@foo:bar@127.0.0.1",
207207
"valid": false,
208208
"warning": null
209-
},
209+
},
210+
{
211+
"auth": null,
212+
"description": "Username containing an unescaped slash",
213+
"hosts": null,
214+
"options": null,
215+
"uri": "mongodb://alice/@localhost/db",
216+
"valid": false,
217+
"warning": null
218+
},
219+
{
220+
"auth": null,
221+
"description": "Username containing unescaped slash with password",
222+
"hosts": null,
223+
"options": null,
224+
"uri": "mongodb://alice/bob:foo@localhost/db",
225+
"valid": false,
226+
"warning": null
227+
},
228+
{
229+
"auth": null,
230+
"description": "Username with password containing an unescaped slash",
231+
"hosts": null,
232+
"options": null,
233+
"uri": "mongodb://alice:foo/bar@localhost/db",
234+
"valid": false,
235+
"warning": null
236+
},
210237
{
211238
"auth": null,
212239
"description": "Host with unescaped slash",
@@ -215,6 +242,24 @@
215242
"uri": "mongodb:///tmp/mongodb-27017.sock/",
216243
"valid": false,
217244
"warning": null
245+
},
246+
{
247+
"auth": null,
248+
"description": "mongodb+srv with multiple service names",
249+
"hosts": null,
250+
"options": null,
251+
"uri": "mongodb+srv://test5.test.mongodb.com,test6.test.mongodb.com",
252+
"valid": false,
253+
"warning": null
254+
},
255+
{
256+
"auth": null,
257+
"description": "mongodb+srv with port number",
258+
"hosts": null,
259+
"options": null,
260+
"uri": "mongodb+srv://test7.test.mongodb.com:27018",
261+
"valid": false,
262+
"warning": null
218263
},
219264
{
220265
"auth": null,
@@ -224,7 +269,6 @@
224269
"uri": "mongodb://alice%foo:bar@127.0.0.1",
225270
"valid": false,
226271
"warning": null
227-
}
228-
272+
}
229273
]
230274
}

‎tests/MongoDB.Driver.Core.Tests/Specifications/connection-string/tests/invalid-uris.yml‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,30 @@ tests:
183183
hosts: ~
184184
auth: ~
185185
options: ~
186+
-
187+
description: "Username containing an unescaped slash"
188+
uri: "mongodb://alice/@localhost/db"
189+
valid: false
190+
warning: ~
191+
hosts: ~
192+
auth: ~
193+
options: ~
194+
-
195+
description: "Username containing unescaped slash with password"
196+
uri: "mongodb://alice/bob:foo@localhost/db"
197+
valid: false
198+
warning: ~
199+
hosts: ~
200+
auth: ~
201+
options: ~
202+
-
203+
description: "Username with password containing an unescaped slash"
204+
uri: "mongodb://alice:foo/bar@localhost/db"
205+
valid: false
206+
warning: ~
207+
hosts: ~
208+
auth: ~
209+
options: ~
186210
-
187211
description: "Host with unescaped slash"
188212
uri: "mongodb:///tmp/mongodb-27017.sock/"
@@ -191,12 +215,27 @@ tests:
191215
hosts: ~
192216
auth: ~
193217
options: ~
218+
-
219+
description: "mongodb+srv with multiple service names"
220+
uri: "mongodb+srv://test5.test.mongodb.com,test6.test.mongodb.com"
221+
valid: false
222+
warning: ~
223+
hosts: ~
224+
auth: ~
225+
options: ~
226+
-
227+
description: "mongodb+srv with port number"
228+
uri: "mongodb+srv://test7.test.mongodb.com:27018"
229+
valid: false
230+
warning: ~
231+
hosts: ~
232+
auth: ~
233+
options: ~
194234
-
195235
description: "Username with password containing an unescaped percent sign"
196236
uri: "mongodb://alice%foo:bar@127.0.0.1"
197237
valid: false
198238
warning: ~
199239
hosts: ~
200240
auth: ~
201-
options: ~
202-
241+
options: ~

‎tests/MongoDB.Driver.Core.Tests/Specifications/connection-string/tests/valid-auth.json‎

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -37,26 +37,7 @@
3737
"uri": "mongodb://alice:foo@127.0.0.1/test",
3838
"valid": true,
3939
"warning": false
40-
},
41-
{
42-
"auth": {
43-
"db": "t\u0000est",
44-
"password": "f\u0000oo",
45-
"username": "a\u0000lice"
46-
},
47-
"description": "User info for single IPv4 host with database (escaped null bytes)",
48-
"hosts": [
49-
{
50-
"host": "127.0.0.1",
51-
"port": null,
52-
"type": "ipv4"
53-
}
54-
],
55-
"options": null,
56-
"uri": "mongodb://a%00lice:f%00oo@127.0.0.1/t%00est",
57-
"valid": true,
58-
"warning": false
59-
},
40+
},
6041
{
6142
"auth": {
6243
"db": null,
@@ -223,7 +204,7 @@
223204
"auth": {
224205
"db": "my=db",
225206
"password": null,
226-
"username": "@l:ce"
207+
"username": "@l:ce/="
227208
},
228209
"description": "Escaped username and database without password",
229210
"hosts": [
@@ -234,14 +215,14 @@
234215
}
235216
],
236217
"options": null,
237-
"uri": "mongodb://%40l%3Ace@example.com/my%3Ddb",
218+
"uri": "mongodb://%40l%3Ace%2F%3D@example.com/my%3Ddb",
238219
"valid": true,
239220
"warning": false
240221
},
241222
{
242223
"auth": {
243224
"db": "admin?",
244-
"password": "f:zzb@zz",
225+
"password": "f:zzb@z/z=",
245226
"username": "$am"
246227
},
247228
"description": "Escaped user info and database (MONGODB-CR)",
@@ -255,10 +236,31 @@
255236
"options": {
256237
"authmechanism": "MONGODB-CR"
257238
},
258-
"uri": "mongodb://%24am:f%3Azzb%40zz@127.0.0.1/admin%3F?authMechanism=MONGODB-CR",
239+
"uri": "mongodb://%24am:f%3Azzb%40z%2Fz%3D@127.0.0.1/admin%3F?authMechanism=MONGODB-CR",
259240
"valid": true,
260241
"warning": false
261-
},
242+
},
243+
{
244+
"description": "Subdelimiters in user/pass don't need escaping (MONGODB-CR)",
245+
"uri": "mongodb://!$&'()*+,;=:!$&'()*+,;=@127.0.0.1/admin?authMechanism=MONGODB-CR",
246+
"valid": true,
247+
"warning": false,
248+
"hosts": [
249+
{
250+
"type": "ipv4",
251+
"host": "127.0.0.1",
252+
"port": null
253+
}
254+
],
255+
"auth": {
256+
"username": "!$&'()*+,;=",
257+
"password": "!$&'()*+,;=",
258+
"db": "admin"
259+
},
260+
"options": {
261+
"authmechanism": "MONGODB-CR"
262+
}
263+
},
262264
{
263265
"auth": {
264266
"db": null,

‎tests/MongoDB.Driver.Core.Tests/Specifications/connection-string/tests/valid-auth.yml‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -29,21 +29,6 @@ tests:
2929
password: "foo"
3030
db: "test"
3131
options: ~
32-
-
33-
description: "User info for single IPv4 host with database (escaped null bytes)"
34-
uri: "mongodb://a%00lice:f%00oo@127.0.0.1/t%00est"
35-
valid: true
36-
warning: false
37-
hosts:
38-
-
39-
type: "ipv4"
40-
host: "127.0.0.1"
41-
port: ~
42-
auth:
43-
username: "a\0lice"
44-
password: "f\0oo"
45-
db: "t\0est"
46-
options: ~
4732
-
4833
description: "User info for single IP literal host without database"
4934
uri: "mongodb://bob:bar@[::1]:27018"
@@ -174,7 +159,7 @@ tests:
174159
options: ~
175160
-
176161
description: "Escaped username and database without password"
177-
uri: "mongodb://%40l%3Ace@example.com/my%3Ddb"
162+
uri: "mongodb://%40l%3Ace%2F%3D@example.com/my%3Ddb"
178163
valid: true
179164
warning: false
180165
hosts:
@@ -183,13 +168,13 @@ tests:
183168
host: "example.com"
184169
port: ~
185170
auth:
186-
username: "@l:ce"
171+
username: "@l:ce/="
187172
password: ~
188173
db: "my=db"
189174
options: ~
190175
-
191176
description: "Escaped user info and database (MONGODB-CR)"
192-
uri: "mongodb://%24am:f%3Azzb%40zz@127.0.0.1/admin%3F?authMechanism=MONGODB-CR"
177+
uri: "mongodb://%24am:f%3Azzb%40z%2Fz%3D@127.0.0.1/admin%3F?authMechanism=MONGODB-CR"
193178
valid: true
194179
warning: false
195180
hosts:
@@ -199,10 +184,26 @@ tests:
199184
port: ~
200185
auth:
201186
username: "$am"
202-
password: "f:zzb@zz"
187+
password: "f:zzb@z/z="
203188
db: "admin?"
204189
options:
205190
authmechanism: "MONGODB-CR"
191+
-
192+
description: "Subdelimiters in user/pass don't need escaping (MONGODB-CR)"
193+
uri: "mongodb://!$&'()*+,;=:!$&'()*+,;=@127.0.0.1/admin?authMechanism=MONGODB-CR"
194+
valid: true
195+
warning: false
196+
hosts:
197+
-
198+
type: "ipv4"
199+
host: "127.0.0.1"
200+
port: ~
201+
auth:
202+
username: "!$&'()*+,;="
203+
password: "!$&'()*+,;="
204+
db: "admin"
205+
options:
206+
authmechanism: "MONGODB-CR"
206207
-
207208
description: "Escaped username (MONGODB-X509)"
208209
uri: "mongodb://CN%3DmyName%2COU%3DmyOrgUnit%2CO%3DmyOrg%2CL%3DmyLocality%2CST%3DmyState%2CC%3DmyCountry@localhost/?authMechanism=MONGODB-X509"

0 commit comments

Comments
 (0)