search

elixir-mongo / mongodb

MongoDB driver for Elixir
Apache License 2.0
571 stars 156 forks source link

Percent encoded passwords in url connection strings are not decoded #320

Closed skizunov closed 5 years ago

skizunov commented 5 years ago

Found with v0.5.1.

Let's say my password is 2yPK}Bzj|qE($^1JDdk4J42*&4lLgV%C. Then the percent encoded version of this password is 2yPK%7DBzj%7CqE%28%24%5E1JDdk4J42%2A%264lLgV%25C and hence the url connection string would be: mongodb://myusername:2yPK%7DBzj%7CqE%28%24%5E1JDdk4J42%2A%264lLgV%25C@mymongodbserver:27017/admin

However, this doesn't work when using the driver. If I don't percent encode the password, and pass it directly instead: mongodb://myusername:2yPK}Bzj|qE($^1JDdk4J42*&4lLgV%C@mymongodbserver:27017/admin It works (when it shouldn't).

The documentation states that usernames and passwords are to be percent encoded: https://docs.mongodb.com/manual/reference/connection-string/#components "If the username or password includes the at sign @, colon :, slash /, or the percent sign % character, use percent encoding."

I have used the percent encoded password on other MongoDB drivers, such as the C# and Python drivers and they work correctly.

ankhers commented 5 years ago

This has been resolved and should be in the next release.