Backport ClickHouse#89970 to 25.8: Fix URL validation in MongoDB engine

Author: robot-clickhouse

src/Storages/StorageMongoDB.cpp

@@ -59,6 +59,8 @@ namespace Setting
     extern const SettingsBool mongodb_throw_on_unsupported_query;
 }
 
+static constexpr const char * MONGODB_RESERVED_CHARS = "!?#/'\",;:$&()[]*+=@";
+
 void MongoDBConfiguration::checkHosts(const ContextPtr & context) const
 {
     // Because domain records will be resolved inside the driver, we can't check resolved IPs for our restrictions.
@@ -108,6 +110,13 @@ Pipe StorageMongoDB::read(
         std::move(options), std::make_shared<const Block>(std::move(sample_block)), max_block_size));
 }
 
+static String encodeString(const String & str)
+{
+    String encoded;
+    Poco::URI::encode(str, MONGODB_RESERVED_CHARS, encoded);
+    return encoded;
+}
+
 static MongoDBConfiguration getConfigurationImpl(const StorageID * table_id, ASTs engine_args, ContextPtr context, bool allow_excessive_path_in_host)
 {
     MongoDBConfiguration configuration;
@@ -124,10 +133,12 @@ static MongoDBConfiguration getConfigurationImpl(const StorageID * table_id, AST
                 "host", "port", "user", "password", "database", "collection"}, {"options", "oid_columns"});
             String user = named_collection->get<String>("user");
             String auth_string;
-            String escaped_password;
-            Poco::URI::encode(named_collection->get<String>("password"), "!?#/'\",;:$&()[]*+=@", escaped_password);
             if (!user.empty())
-                auth_string = fmt::format("{}:{}@", user, escaped_password);
+            {
+                String escaped_user = encodeString(user);
+                String escaped_password = encodeString(named_collection->get<String>("password"));
+                auth_string = fmt::format("{}:{}@", escaped_user, escaped_password);
+            }
             configuration.uri = std::make_unique<mongocxx::uri>(fmt::format("mongodb://{}{}:{}/{}?{}",
                                                           auth_string,
                                                           named_collection->get<String>("host"),
@@ -154,10 +165,12 @@ static MongoDBConfiguration getConfigurationImpl(const StorageID * table_id, AST
 
             String user = checkAndGetLiteralArgument<String>(engine_args[3], "user");
             String auth_string;
-            String escaped_password;
-            Poco::URI::encode(checkAndGetLiteralArgument<String>(engine_args[4], "password"), "!?#/'\",;:$&()[]*+=@", escaped_password);
             if (!user.empty())
-                auth_string = fmt::format("{}:{}@", user, escaped_password);
+            {
+                String escaped_user = encodeString(user);
+                String escaped_password = encodeString(checkAndGetLiteralArgument<String>(engine_args[4], "password"));
+                auth_string = fmt::format("{}:{}@", escaped_user, escaped_password);
+            }
 
             auto host_port = checkAndGetLiteralArgument<String>(engine_args[0], "host:port");
             auto database_name = checkAndGetLiteralArgument<String>(engine_args[1], "database");

tests/integration/test_storage_mongodb/test.py

@@ -1471,3 +1471,23 @@ def test_numbers_parsing(started_cluster):
 
     node.query("DROP TABLE numbers_parsing_table")
     numbers_parsing_table.drop()
+
+
+def test_url_validation(started_cluster):
+    mongo_connection = get_mongo_connection(started_cluster)
+    db = mongo_connection["test"]
+    db.command("dropAllUsersFromDatabase")
+    db.command("createUser", "[email protected]", pwd=mongo_pass, roles=["readWrite"])
+    drop_mongo_collection_if_exists(db, "url_validation_table")
+    url_validation_table = db["url_validation_table"]
+    data = []
+    for i in range(0, 100):
+        data.append({"key": i, "data": hex(i * i)})
+    url_validation_table.insert_many(data)
+
+    node = started_cluster.instances["node"]
+    node.query(
+        f"CREATE OR REPLACE TABLE url_validation_table(key UInt64, data String) ENGINE = MongoDB('mongo1', 'test', 'url_validation_table', '[email protected]', '{mongo_pass}')"
+    )
+
+    assert node.query("SELECT COUNT() FROM url_validation_table") == "100\n"