Skip to content

Redact TLS keyfile password from client repr#2830

Open
dfgvaetyj3456356-hash wants to merge 1 commit into
mongodb:masterfrom
dfgvaetyj3456356-hash:security/redact-tls-passphrase-repr
Open

Redact TLS keyfile password from client repr#2830
dfgvaetyj3456356-hash wants to merge 1 commit into
mongodb:masterfrom
dfgvaetyj3456356-hash:security/redact-tls-passphrase-repr

Conversation

@dfgvaetyj3456356-hash
Copy link
Copy Markdown

Summary

  • redact tlsCertificateKeyFilePassword when rendering MongoClient/AsyncMongoClient repr output
  • preserve existing repr formatting for non-sensitive options
  • add sync and async unit regression coverage

Why

tlsCertificateKeyFilePassword is a passphrase for encrypted client certificate key files. Before this change, creating a client with that option and logging or inspecting repr(client) included the raw passphrase. This keeps the option visible for debugging while avoiding disclosure of the secret value.

This is intentionally scoped to the TLS keyfile passphrase and does not touch authMechanismProperties, which is already covered by a separate open PR.

Test

python -m pytest test\test_client.py::ClientUnitTest::test_repr_redacts_tls_certificate_keyfile_password test\asynchronous\test_client.py::AsyncClientUnitTest::test_repr_redacts_tls_certificate_keyfile_password -q
python -m py_compile pymongo\synchronous\mongo_client.py pymongo\asynchronous\mongo_client.py test\test_client.py test\asynchronous\test_client.py
git diff --check

Signed-off-by: dfgvaetyj3456356-hash <185460949+dfgvaetyj3456356-hash@users.noreply.github.com>
@dfgvaetyj3456356-hash dfgvaetyj3456356-hash requested a review from a team as a code owner May 31, 2026 09:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants