Skip to content

Commit b659a83

Browse files
authored
GODRIVER-449 Correctly unescape usernames and passwords in connection strings. (#1014)
1 parent d6ab9dd commit b659a83

File tree

3 files changed

+39
-2
lines changed

3 files changed

+39
-2
lines changed

data/connection-string/valid-auth.json

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,27 @@
240240
"authmechanism": "MONGODB-CR"
241241
}
242242
},
243+
{
244+
"description": "Subdelimiters in user/pass don't need escaping (MONGODB-CR)",
245+
"uri": "mongodb://!$&'()*+,;=:!$&'()*+,;[email protected]/admin?authMechanism=MONGODB-CR",
246+
"valid": true,
247+
"warning": false,
248+
"hosts": [
249+
{
250+
"type": "ipv4",
251+
"host": "127.0.0.1",
252+
"port": null
253+
}
254+
],
255+
"auth": {
256+
"username": "!$&'()*+,;=",
257+
"password": "!$&'()*+,;=",
258+
"db": "admin"
259+
},
260+
"options": {
261+
"authmechanism": "MONGODB-CR"
262+
}
263+
},
243264
{
244265
"description": "Escaped username (MONGODB-X509)",
245266
"uri": "mongodb://CN%3DmyName%2COU%3DmyOrgUnit%2CO%3DmyOrg%2CL%3DmyLocality%2CST%3DmyState%2CC%3DmyCountry@localhost/?authMechanism=MONGODB-X509",

data/connection-string/valid-auth.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,22 @@ tests:
188188
db: "admin?"
189189
options:
190190
authmechanism: "MONGODB-CR"
191+
-
192+
description: "Subdelimiters in user/pass don't need escaping (MONGODB-CR)"
193+
uri: "mongodb://!$&'()*+,;=:!$&'()*+,;[email protected]/admin?authMechanism=MONGODB-CR"
194+
valid: true
195+
warning: false
196+
hosts:
197+
-
198+
type: "ipv4"
199+
host: "127.0.0.1"
200+
port: ~
201+
auth:
202+
username: "!$&'()*+,;="
203+
password: "!$&'()*+,;="
204+
db: "admin"
205+
options:
206+
authmechanism: "MONGODB-CR"
191207
-
192208
description: "Escaped username (MONGODB-X509)"
193209
uri: "mongodb://CN%3DmyName%2COU%3DmyOrgUnit%2CO%3DmyOrg%2CL%3DmyLocality%2CST%3DmyState%2CC%3DmyCountry@localhost/?authMechanism=MONGODB-X509"

x/mongo/driver/connstring/connstring.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ func (p *parser) parse(original string) error {
233233
if strings.Contains(username, "/") {
234234
return fmt.Errorf("unescaped slash in username")
235235
}
236-
p.Username, err = url.QueryUnescape(username)
236+
p.Username, err = url.PathUnescape(username)
237237
if err != nil {
238238
return internal.WrapErrorf(err, "invalid username")
239239
}
@@ -246,7 +246,7 @@ func (p *parser) parse(original string) error {
246246
if strings.Contains(password, "/") {
247247
return fmt.Errorf("unescaped slash in password")
248248
}
249-
p.Password, err = url.QueryUnescape(password)
249+
p.Password, err = url.PathUnescape(password)
250250
if err != nil {
251251
return internal.WrapErrorf(err, "invalid password")
252252
}

0 commit comments

Comments
 (0)