-
Type:
Bug
-
Resolution: Won't Fix
-
Priority:
Minor - P4
-
None
-
Affects Version/s: None
-
Component/s: Shell
-
None
-
DevProd Test Infrastructure
-
DevProd Test Infra 2026-08-11
-
None
-
None
-
None
-
None
-
None
-
None
-
None
The legacy mongo shell filters credential-bearing lines out of `~/.dbshell`,
but the filter missed several common syntactic forms, so plaintext passwords
were written to disk. Newly redacted:
| Form | Example |
| — | — |
| Bracket-notation helpers | `db["auth"]("admin", "pw")` |
| Quoted command keys | `db.runCommand(
{"createUser": ..., pwd: "pw"}
)` |
| `authenticate` / role commands | `db.runCommand(
{authenticate: 1, pwd: "pw"}
)` |
| Passwords in connection strings | `new Mongo("mongodb://u:pw@host")`, `connect(...)` |
| Any credential key, anywhere | `pwd`, `password`, `secretAccessKey`, `sessionToken`, ... |
Previously only dot-notation helpers (`db.auth(...)`), unquoted `createUser`/`updateUser` keys, and `Mongo(...)` containing `secretAccessKey` were caught. Lines like `book.author` are still recorded.
The filter moved from `shellHistoryAdd` in `mongo_main.cpp` to `shell_utils::shouldRedactFromHistory()` so it can be unit tested; `mongo_main.cpp` has no test target.
Note this does not scrub already-leaked `~/.dbshell` files, and the approach remains a denylist.
-
-
- Testing
-
- New `ShellHistoryRedaction` cases in `shell_utils_test.cpp`; 4 of 5 fail against the old patterns.
- End-to-end against a live mongod: all four password forms land in `~/.dbshell` before the change, none after (a benign canary line confirms history is still written).