PYTHON-5927 Redact TLS keyfile password from client repr#2830
PYTHON-5927 Redact TLS keyfile password from client repr#2830dfgvaetyj3456356-hash wants to merge 2 commits into
Conversation
Signed-off-by: dfgvaetyj3456356-hash <185460949+dfgvaetyj3456356-hash@users.noreply.github.com>
|
Assigned |
There was a problem hiding this comment.
Pull request overview
This PR prevents accidental secret disclosure by redacting the TLS client key passphrase (tlsCertificateKeyFilePassword / tlscertificatekeyfilepassword) from MongoClient and AsyncMongoClient repr() output, while keeping the option visible for debugging. It adds regression tests to ensure the passphrase no longer appears in repr(client).
Changes:
- Redact
tlscertificatekeyfilepasswordinMongoClient/AsyncMongoClientrepr rendering. - Add sync + async unit tests asserting
repr()contains'<redacted>'and does not contain the raw passphrase.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| test/test_client.py | Adds a unit test verifying TLS keyfile passphrase is redacted from MongoClient.__repr__. |
| test/asynchronous/test_client.py | Adds a unit test verifying TLS keyfile passphrase is redacted from AsyncMongoClient.__repr__. |
| pymongo/synchronous/mongo_client.py | Implements repr redaction for tlscertificatekeyfilepassword. |
| pymongo/asynchronous/mongo_client.py | Implements repr redaction for tlscertificatekeyfilepassword. |
| if option in {"tlscertificatekeyfilepassword"}: | ||
| return f"{option}='<redacted>'" |
| if option in {"tlscertificatekeyfilepassword"}: | ||
| return f"{option}='<redacted>'" |
|
Hi, thanks for your contribution. Please update your pull request to be in line with out pull request template guidelines. |
Summary
tlsCertificateKeyFilePasswordwhen renderingMongoClient/AsyncMongoClientrepr outputWhy
tlsCertificateKeyFilePasswordis a passphrase for encrypted client certificate key files. Before this change, creating a client with that option and logging or inspectingrepr(client)included the raw passphrase. This keeps the option visible for debugging while avoiding disclosure of the secret value.This is intentionally scoped to the TLS keyfile passphrase and does not touch
authMechanismProperties, which is already covered by a separate open PR.Test