feat(NODE-6289): allow valid srv hostnames with less than 3 parts

src/connection_string.ts

@@ -34,11 +34,11 @@ import { ReadPreference, type ReadPreferenceMode } from './read_preference';
 import { ServerMonitoringMode } from './sdam/monitor';
 import type { TagSet } from './sdam/server_description';
 import {
+  checkParentDomainMatch,
   DEFAULT_PK_FACTORY,
   emitWarning,
   HostAddress,
   isRecord,
-  matchesParentDomain,
   parseInteger,
   setDifference,
   squashError
@@ -64,11 +64,6 @@ export async function resolveSRVRecord(options: MongoOptions): Promise<HostAddre
     throw new MongoAPIError('Option "srvHost" must not be empty');
   }
 
-  if (options.srvHost.split('.').length < 3) {
-    // TODO(NODE-3484): Replace with MongoConnectionStringError
-    throw new MongoAPIError('URI must include hostname, domain name, and tld');
-  }
-
   // Asynchronously start TXT resolution so that we do not have to wait until
   // the SRV record is resolved before starting a second DNS query.
   const lookupAddress = options.srvHost;
@@ -86,9 +81,7 @@ export async function resolveSRVRecord(options: MongoOptions): Promise<HostAddre
   }
 
   for (const { name } of addresses) {
-    if (!matchesParentDomain(name, lookupAddress)) {
-      throw new MongoAPIError('Server record does not share hostname with parent URI');
-    }
+    checkParentDomainMatch(name, lookupAddress);
   }
 
   const hostAddresses = addresses.map(r => HostAddress.fromString(`${r.name}:${r.port ?? 27017}`));

src/sdam/srv_polling.ts

@@ -3,7 +3,7 @@ import { clearTimeout, setTimeout } from 'timers';
 
 import { MongoRuntimeError } from '../error';
 import { TypedEventEmitter } from '../mongo_types';
-import { HostAddress, matchesParentDomain, squashError } from '../utils';
+import { checkParentDomainMatch, HostAddress, squashError } from '../utils';
 
 /**
  * @internal
@@ -127,8 +127,11 @@ export class SrvPoller extends TypedEventEmitter<SrvPollerEvents> {
 
     const finalAddresses: dns.SrvRecord[] = [];
     for (const record of srvRecords) {
-      if (matchesParentDomain(record.name, this.srvHost)) {
+      try {
+        checkParentDomainMatch(record.name, this.srvHost);
         finalAddresses.push(record);
+      } catch (error) {
+        squashError(error);
       }
     }
 

src/utils.ts

@@ -18,6 +18,7 @@ import type { FindCursor } from './cursor/find_cursor';
 import type { Db } from './db';
 import {
   type AnyError,
+  MongoAPIError,
   MongoCompatibilityError,
   MongoInvalidArgumentError,
   MongoNetworkTimeoutError,
@@ -1142,29 +1143,46 @@ export function parseUnsignedInteger(value: unknown): number | null {
 }
 
 /**
- * Determines whether a provided address matches the provided parent domain.
+ * This function throws a MongoAPIError in the event that either of the following is true:
+ * * If the provided address domain does not match the provided parent domain
+ * * If the parent domain contains less than three `.` separated parts and the provided address does not contain at least one more domain level than its parent
  *
  * If a DNS server were to become compromised SRV records would still need to
  * advertise addresses that are under the same domain as the srvHost.
  *
  * @param address - The address to check against a domain
  * @param srvHost - The domain to check the provided address against
- * @returns Whether the provided address matches the parent domain
+ * @returns void
  */
-export function matchesParentDomain(address: string, srvHost: string): boolean {
+export function checkParentDomainMatch(address: string, srvHost: string): void {
   // Remove trailing dot if exists on either the resolved address or the srv hostname
   const normalizedAddress = address.endsWith('.') ? address.slice(0, address.length - 1) : address;
   const normalizedSrvHost = srvHost.endsWith('.') ? srvHost.slice(0, srvHost.length - 1) : srvHost;
 
   const allCharacterBeforeFirstDot = /^.*?\./;
+  const srvIsLessThanThreeParts = srvHost.split('.').length < 3;
   // Remove all characters before first dot
   // Add leading dot back to string so
   //   an srvHostDomain = '.trusted.site'
   //   will not satisfy an addressDomain that endsWith '.fake-trusted.site'
-  const addressDomain = `.${normalizedAddress.replace(allCharacterBeforeFirstDot, '')}`;
-  const srvHostDomain = `.${normalizedSrvHost.replace(allCharacterBeforeFirstDot, '')}`;
-
-  return addressDomain.endsWith(srvHostDomain);
+  const addressDomain = srvIsLessThanThreeParts
+    ? normalizedAddress
+    : `.${normalizedAddress.replace(allCharacterBeforeFirstDot, '')}`;
+  const srvHostDomain = srvIsLessThanThreeParts
+    ? normalizedSrvHost
+    : `.${normalizedSrvHost.replace(allCharacterBeforeFirstDot, '')}`;
+
+  if (!addressDomain.endsWith(srvHostDomain)) {
+    // TODO(NODE-3484): Replace with MongoConnectionStringError
+    throw new MongoAPIError('Server record does not share hostname with parent URI');
+  }
+  if (
+    srvIsLessThanThreeParts &&
+    normalizedAddress.split('.').length <= normalizedSrvHost.split('.').length
+  ) {
+    // TODO(NODE-3484): Replace with MongoConnectionStringError
+    throw new MongoAPIError('Server record does not have least one more domain than parent URI');
+  }
 }
 
 interface RequestOptions {

test/integration/initial-dns-seedlist-discovery/initial_dns_seedlist_discovery.prose.test.ts

@@ -0,0 +1,182 @@
+import { expect } from 'chai';
+import * as dns from 'dns';
+import * as sinon from 'sinon';
+
+import { MongoAPIError, Server, ServerDescription, Topology } from '../../mongodb';
+import { topologyWithPlaceholderClient } from '../../tools/utils';
+
+describe('Initial DNS Seedlist Discovery (Prose Tests)', () => {
+  context('1) When running validation on an SRV string before DNS resolution', function () {
+    beforeEach(async function () {
+      // this fn stubs DNS resolution to always pass - so we are only checking pre-DNS validation
+
+      sinon.stub(dns.promises, 'resolveSrv').callsFake(async () => {
+        return [
+          {
+            name: 'resolved.mongodb.localhost',
+            port: 27017,
+            weight: 0,
+            priority: 0
+          }
+        ];
+      });
+
+      sinon.stub(dns.promises, 'resolveTxt').callsFake(async () => {
+        throw { code: 'ENODATA' };
+      });
+
+      sinon.stub(Topology.prototype, 'selectServer').callsFake(async () => {
+        return new Server(
+          topologyWithPlaceholderClient([], {} as any),
+          new ServerDescription('a:1'),
+          {} as any
+        );
+      });
+    });
+
+    afterEach(async function () {
+      sinon.restore();
+    });
+
+    it('does not error on an SRV because it has one domain level', async function () {
+      const client = await this.configuration.newClient('mongodb+srv://localhost', {});
+      client.connect();
+      client.close();
+    });
+
+    it('does not error on an SRV because it has two domain levels', async function () {
+      const client = await this.configuration.newClient('mongodb+srv://mongodb.localhost', {});
+      client.connect();
+      client.close();
+    });
+  });
+
+  context(
+    '2) When given a host from DNS resolution that does NOT end with the original SRVs domain name',
+    function () {
+      beforeEach(async function () {
+        sinon.stub(dns.promises, 'resolveTxt').callsFake(async () => {
+          throw { code: 'ENODATA' };
+        });
+      });
+
+      afterEach(async function () {
+        sinon.restore();
+      });
+
+      it('an SRV with one domain level causes a runtime error', async function () {
+        sinon.stub(dns.promises, 'resolveSrv').callsFake(async () => {
+          return [
+            {
+              name: 'localhost.mongodb', // this string contains the SRV but does not end with it
+              port: 27017,
+              weight: 0,
+              priority: 0
+            }
+          ];
+        });
+        const err = await this.configuration
+          .newClient('mongodb+srv://localhost', {})
+          .connect()
+          .catch((e: any) => e);
+        expect(err).to.be.instanceOf(MongoAPIError);
+        expect(err.message).to.equal('Server record does not share hostname with parent URI');
+      });
+
+      it('an SRV with two domain levels causes a runtime error', async function () {
+        sinon.stub(dns.promises, 'resolveSrv').callsFake(async () => {
+          return [
+            {
+              name: 'evil.localhost', // this string only ends with part of the domain, not all of it!
+              port: 27017,
+              weight: 0,
+              priority: 0
+            }
+          ];
+        });
+        const err = await this.configuration
+          .newClient('mongodb+srv://mongodb.localhost', {})
+          .connect()
+          .catch(e => e);
+        expect(err).to.be.instanceOf(MongoAPIError);
+        expect(err.message).to.equal('Server record does not share hostname with parent URI');
+      });
+
+      it('an SRV with three or more domain levels causes a runtime error', async function () {
+        sinon.stub(dns.promises, 'resolveSrv').callsFake(async () => {
+          return [
+            {
+              name: 'blogs.evil.co.uk',
+              port: 27017,
+              weight: 0,
+              priority: 0
+            }
+          ];
+        });
+        const err = await this.configuration
+          .newClient('mongodb+srv://blogs.mongodb.com', {})
+          .connect()
+          .catch(e => e);
+        expect(err).to.be.instanceOf(MongoAPIError);
+        expect(err.message).to.equal('Server record does not share hostname with parent URI');
+      });
+    }
+  );
+
+  context(
+    '3) When given a host from DNS resolution that is identical to the original SRVs hostname',
+    function () {
+      beforeEach(async function () {
+        sinon.stub(dns.promises, 'resolveTxt').callsFake(async () => {
+          throw { code: 'ENODATA' };
+        });
+      });
+
+      afterEach(async function () {
+        sinon.restore();
+      });
+
+      it('an SRV with one domain level causes a runtime error', async function () {
+        sinon.stub(dns.promises, 'resolveSrv').callsFake(async () => {
+          return [
+            {
+              name: 'localhost',
+              port: 27017,
+              weight: 0,
+              priority: 0
+            }
+          ];
+        });
+        const err = await this.configuration
+          .newClient('mongodb+srv://localhost', {})
+          .connect()
+          .catch(e => e);
+        expect(err).to.be.instanceOf(MongoAPIError);
+        expect(err.message).to.equal(
+          'Server record does not have least one more domain than parent URI'
+        );
+      });
+
+      it('an SRV with two domain levels causes a runtime error', async function () {
+        sinon.stub(dns.promises, 'resolveSrv').callsFake(async () => {
+          return [
+            {
+              name: 'mongodb.localhost',
+              port: 27017,
+              weight: 0,
+              priority: 0
+            }
+          ];
+        });
+        const err = await this.configuration
+          .newClient('mongodb+srv://mongodb.localhost', {})
+          .connect()
+          .catch(e => e);
+        expect(err).to.be.instanceOf(MongoAPIError);
+        expect(err.message).to.equal(
+          'Server record does not have least one more domain than parent URI'
+        );
+      });
+    }
+  );
+});

test/unit/utils.test.ts

@@ -3,6 +3,7 @@ import { expect } from 'chai';
 import {
   BufferPool,
   ByteUtils,
+  checkParentDomainMatch,
   compareObjectId,
   decorateWithExplain,
   Explain,
@@ -12,7 +13,6 @@ import {
   isUint8Array,
   LEGACY_HELLO_COMMAND,
   List,
-  matchesParentDomain,
   MongoDBCollectionNamespace,
   MongoDBNamespace,
   MongoRuntimeError,
@@ -939,7 +939,7 @@ describe('driver utils', function () {
     });
   });
 
-  describe('matchesParentDomain()', () => {
+  describe('checkParentDomainMatch()', () => {
     const exampleSrvName = 'i-love-javascript.mongodb.io';
     const exampleSrvNameWithDot = 'i-love-javascript.mongodb.io.';
     const exampleHostNameWithoutDot = 'i-love-javascript-00.mongodb.io';
@@ -948,35 +948,46 @@ describe('driver utils', function () {
     const exampleHostNamThatDoNotMatchParentWithDot = 'i-love-javascript-00.evil-mongodb.io.';
 
     context('when address does not match parent domain', () => {
-      it('without a trailing dot returns false', () => {
-        expect(matchesParentDomain(exampleHostNamThatDoNotMatchParent, exampleSrvName)).to.be.false;
+      it('without a trailing dot throws', () => {
+        expect(() =>
+          checkParentDomainMatch(exampleHostNamThatDoNotMatchParent, exampleSrvName)
+        ).to.throw('Server record does not share hostname with parent URI');
       });
 
-      it('with a trailing dot returns false', () => {
-        expect(matchesParentDomain(exampleHostNamThatDoNotMatchParentWithDot, exampleSrvName)).to.be
-          .false;
+      it('with a trailing dot throws', () => {
+        expect(() =>
+          checkParentDomainMatch(exampleHostNamThatDoNotMatchParentWithDot, exampleSrvName)
+        ).to.throw('Server record does not share hostname with parent URI');
       });
     });
 
     context('when addresses in SRV record end with a dot', () => {
       it('accepts address since it is considered to still match the parent domain', () => {
-        expect(matchesParentDomain(exampleHostNamesWithDot, exampleSrvName)).to.be.true;
+        expect(() =>
+          checkParentDomainMatch(exampleHostNamesWithDot, exampleSrvName)
+        ).to.not.throw();
       });
     });
 
     context('when SRV host ends with a dot', () => {
       it('accepts address if it ends with a dot', () => {
-        expect(matchesParentDomain(exampleHostNamesWithDot, exampleSrvNameWithDot)).to.be.true;
+        expect(() =>
+          checkParentDomainMatch(exampleHostNamesWithDot, exampleSrvNameWithDot)
+        ).to.not.throw();
       });
 
       it('accepts address if it does not end with a dot', () => {
-        expect(matchesParentDomain(exampleHostNameWithoutDot, exampleSrvName)).to.be.true;
+        expect(() =>
+          checkParentDomainMatch(exampleHostNameWithoutDot, exampleSrvName)
+        ).to.not.throw();
       });
     });
 
     context('when addresses in SRV record end without dots', () => {
       it('accepts address since it matches the parent domain', () => {
-        expect(matchesParentDomain(exampleHostNamesWithDot, exampleSrvName)).to.be.true;
+        expect(() =>
+          checkParentDomainMatch(exampleHostNamesWithDot, exampleSrvName)
+        ).to.not.throw();
       });
     });
   });