MongoUrlBuilder.ToString() concatenates string-valued settings into the connection string without percent-encoding, so a value containing a reserved character ('?', '&', ',') silently changes the meaning of the URL when ToMongoUrl() re-parses it. ConnectionString.BuildResolvedConnectionString already escapes correctly and should be mirrored.
To dos:
- The database name and all option values are percent-encoded in MongoUrlBuilder.ToString(), matching ConnectionString.BuildResolvedConnectionString, including its authMechanismProperties carve-out and the key:value halves of readPreferenceTags.
- MongoServerAddress rejects hosts containing ',', '/', '?', '@' or '#'.
- MongoUrl.Equals, GetHashCode and MongoUrl.Create no longer conflate connection strings that differ only in escaping.
- A round-trip test asserts parse (ToString(parse(a))) == parse(a) over the reserved-character set for every string-valued setting.
Same in 3.x and 2.x
- related to
-
CSHARP-6171 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
-
- Closed
-