Connection-option injection via unescaped settings in the canonical MongoDB URL builder

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Critical - P2
    • 3.11.1
    • Affects Version/s: None
    • Component/s: None
    • None
    • 0.5
    • Minor Change
    • Dotnet Drivers
    • Not Needed
    • None
    • None
    • None
    • None
    • None
    • None

      MongoUrlBuilder.ToString() concatenates string-valued settings into the connection string without percent-encoding, so a value containing a reserved character ('?', '&', ',') silently changes the meaning of the URL when ToMongoUrl() re-parses it. ConnectionString.BuildResolvedConnectionString already escapes correctly and should be mirrored.

      To dos:

      • The database name and all option values are percent-encoded in MongoUrlBuilder.ToString(), matching ConnectionString.BuildResolvedConnectionString, including its authMechanismProperties carve-out and the key:value halves of readPreferenceTags.
      • MongoServerAddress rejects hosts containing ',', '/', '?', '@' or '#'.
      • MongoUrl.Equals, GetHashCode and MongoUrl.Create no longer conflate connection strings that differ only in escaping.
      • A round-trip test asserts parse (ToString(parse(a))) == parse(a) over the reserved-character set for every string-valued setting.

      Same in 3.x and 2.x

            Assignee:
            Ferdinando Papale
            Reporter:
            Ferdinando Papale
            None
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: