Uploaded image for project: 'C Driver'
  1. C Driver
  2. CDRIVER-2020

Escaped null bytes in URI (%00) should be allowed

    • Type: Icon: Task Task
    • Resolution: Won't Fix
    • Priority: Icon: Major - P3 Major - P3
    • 1.7.0
    • Affects Version/s: None
    • Component/s: None
    • Labels:
      None

      diff --git a/tests/json/connection_uri/valid-auth.json b/tests/json/connection_uri/valid-auth.json
      index 0b04f7d..36a7be3 100644
      --- a/tests/json/connection_uri/valid-auth.json
      +++ b/tests/json/connection_uri/valid-auth.json
      @@ -39,25 +39,6 @@
             "options": null
           },
           {
      -      "description": "User info for single IPv4 host with database (escaped null bytes)",
      -      "uri": "mongodb://a%00lice:f%00oo@127.0.0.1/t%00est",
      -      "valid": true,
      -      "warning": false,
      -      "hosts": [
      -        {
      -          "type": "ipv4",
      -          "host": "127.0.0.1",
      -          "port": null
      -        }
      -      ],
      -      "auth": {
      -        "username": "a\u0000lice",
      -        "password": "f\u0000oo",
      -        "db": "t\u0000est"
      -      },
      -      "options": null
      -    },
      -    {
             "description": "User info for single IP literal host without database",
             "uri": "mongodb://bob:bar@[::1]:27018",
             "valid": true,
      @@ -327,4 +308,4 @@
             }
           }
         ]
      -}
      \ No newline at end of file
      +}
      
      diff --git a/tests/json/connection_uri/valid-options.json b/tests/json/connection_uri/valid-options.json
      index 2a29ce2..4c2bded 100644
      --- a/tests/json/connection_uri/valid-options.json
      +++ b/tests/json/connection_uri/valid-options.json
      @@ -20,23 +20,6 @@
             "options": {
               "authmechanism": "MONGODB-CR"
             }
      -    },
      -    {
      -      "description": "Option key and value (escaped null bytes)",
      -      "uri": "mongodb://example.com/?replicaSet=my%00rs",
      -      "valid": true,
      -      "warning": false,
      -      "hosts": [
      -        {
      -          "type": "hostname",
      -          "host": "example.com",
      -          "port": null
      -        }
      -      ],
      -      "auth": null,
      -      "options": {
      -        "replicaset": "my\u0000rs"
      -      }
           }
         ]
      -}
      \ No newline at end of file
      +}
      

      Note that we have an explicit test that makes sure this is disallowed:

      tests/test-mongoc-uri.c:722    ASSERT_URIDECODE_FAIL ("%00");                                                    
      

            Assignee:
            bjori Hannes Magnusson
            Reporter:
            bjori Hannes Magnusson
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: