mongodb/mongo-python-driver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge 24f74fd8db into 552b7bf47b

Browse Source
This commit is contained in:
NguyenCong2k 2026-05-14 17:06:12 +00:00 committed by GitHub
commit 7d6793b5ef
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 99 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pymongo/asynchronous/mongo_client.py
View File

@ -1307,6 +1307,8 @@ class AsyncMongoClient(common.BaseObject, Generic[_DocumentType]):
return "document_class=dict"
else:
return f"document_class={value.__module__}.{value.__name__}"
if option == "authmechanismproperties":
value = common.redact_auth_mechanism_properties_for_repr(value)
if option in common.TIMEOUT_OPTIONS and value is not None:
return f"{option}={int(value * 1000)}"

25
pymongo/common.py
View File

@ -426,6 +426,31 @@ _MECHANISM_PROPS = frozenset(
)
_SAFE_AUTH_MECHANISM_PROPS_FOR_REPR = frozenset(
[
"ALLOWED_HOSTS",
"CANONICALIZE_HOST_NAME",
"ENVIRONMENT",
"SERVICE_HOST",
"SERVICE_NAME",
"SERVICE_REALM",
"TOKEN_RESOURCE",
]
)
def redact_auth_mechanism_properties_for_repr(value: Any) -> Any:
"""Redact sensitive auth mechanism properties before including them in repr."""
if not isinstance(value, dict):
return value
redacted = value.copy()
for key in redacted:
if str(key).upper() not in _SAFE_AUTH_MECHANISM_PROPS_FOR_REPR:
redacted[key] = "<redacted>"
return redacted
def validate_auth_mechanism_properties(option: str, value: Any) -> dict[str, Union[bool, str]]:
"""Validate authMechanismProperties."""
props: dict[str, Any] = {}

2
pymongo/synchronous/mongo_client.py
View File

@ -1307,6 +1307,8 @@ class MongoClient(common.BaseObject, Generic[_DocumentType]):
return "document_class=dict"
else:
return f"document_class={value.__module__}.{value.__name__}"
if option == "authmechanismproperties":
value = common.redact_auth_mechanism_properties_for_repr(value)
if option in common.TIMEOUT_OPTIONS and value is not None:
return f"{option}={int(value * 1000)}"

35
test/asynchronous/test_client.py
View File

@ -195,6 +195,41 @@ class AsyncClientUnitTest(AsyncUnitTest):
self.assertRaises(ConfigurationError, AsyncMongoClient, [])
async def test_repr_redacts_aws_session_token(self):
token = "SECRET_AWS_SESSION_TOKEN"
client = AsyncMongoClient(
"mongodb://AKIA:SECRET@localhost:27017/"
f"?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:{token}",
connect=False,
)
the_repr = repr(client)
self.assertNotIn(token, the_repr)
self.assertIn("'AWS_SESSION_TOKEN': '<redacted>'", the_repr)
async def test_repr_redacts_secret_auth_mechanism_properties(self):
token = "SECRET_AWS_SESSION_TOKEN"
api_key = "SECRET_API_KEY"
client = AsyncMongoClient(
"mongodb://AKIA:SECRET@localhost:27017/",
authMechanism="MONGODB-AWS",
authMechanismProperties={
"aws_session_token": token,
"CUSTOM_API_KEY": api_key,
"TOKEN_RESOURCE": "mongodb://cluster.example",
},
connect=False,
)
the_repr = repr(client)
self.assertNotIn(token, the_repr)
self.assertNotIn(api_key, the_repr)
self.assertIn("'aws_session_token': '<redacted>'", the_repr)
self.assertIn("'CUSTOM_API_KEY': '<redacted>'", the_repr)
self.assertIn("'TOKEN_RESOURCE': 'mongodb://cluster.example'", the_repr)
async def test_max_pool_size_zero(self):
self.simple_client(maxPoolSize=0)

35
test/test_client.py
View File

@ -192,6 +192,41 @@ class ClientUnitTest(UnitTest):
self.assertRaises(ConfigurationError, MongoClient, [])
def test_repr_redacts_aws_session_token(self):
token = "SECRET_AWS_SESSION_TOKEN"
client = MongoClient(
"mongodb://AKIA:SECRET@localhost:27017/"
f"?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:{token}",
connect=False,
)
the_repr = repr(client)
self.assertNotIn(token, the_repr)
self.assertIn("'AWS_SESSION_TOKEN': '<redacted>'", the_repr)
def test_repr_redacts_secret_auth_mechanism_properties(self):
token = "SECRET_AWS_SESSION_TOKEN"
api_key = "SECRET_API_KEY"
client = MongoClient(
"mongodb://AKIA:SECRET@localhost:27017/",
authMechanism="MONGODB-AWS",
authMechanismProperties={
"aws_session_token": token,
"CUSTOM_API_KEY": api_key,
"TOKEN_RESOURCE": "mongodb://cluster.example",
},
connect=False,
)
the_repr = repr(client)
self.assertNotIn(token, the_repr)
self.assertNotIn(api_key, the_repr)
self.assertIn("'aws_session_token': '<redacted>'", the_repr)
self.assertIn("'CUSTOM_API_KEY': '<redacted>'", the_repr)
self.assertIn("'TOKEN_RESOURCE': 'mongodb://cluster.example'", the_repr)
def test_max_pool_size_zero(self):
self.simple_client(maxPoolSize=0)