(EAI-929): Redact connection URIs from messages (#685)

redaction action

Co-authored-by: Ben Perlmutter <mongodben@mongodb.com>

Author: mongodben

packages/chatbot-server-mongodb-public/src/config.ts

@@ -27,6 +27,7 @@ import { blockGetRequests } from "./middleware/blockGetRequests";
 import { getRequestId, logRequest } from "./utils";
 import { systemPrompt } from "./systemPrompt";
 import { addReferenceSourceType } from "./processors/makeMongoDbReferences";
+import { redactConnectionUri } from "./middleware/redactConnectionUri";
 import path from "path";
 import express from "express";
 import { wrapOpenAI, wrapTraced } from "mongodb-rag-core/braintrust";
@@ -243,6 +244,7 @@ export const config: AppConfig = {
       requireRequestOrigin(),
       useSegmentIds(),
       cookieParser(),
+      redactConnectionUri(),
     ],
     createConversationCustomData: !isProduction
       ? createConversationCustomDataWithAuthUser

packages/chatbot-server-mongodb-public/src/middleware/redactConnectionUri.test.ts

@@ -0,0 +1,124 @@
+import { redactConnectionUri } from "./redactConnectionUri";
+import {
+  createConversationsMiddlewareReq,
+  createConversationsMiddlewareRes,
+} from "../test/middlewareTestHelpers";
+
+const baseReq = {
+  body: { message: "Hello, world!" },
+  params: { conversationId: "conversation-1234" },
+  query: { stream: "true" },
+  headers: { "req-id": "request-1234" },
+};
+
+describe("redactConnectionUri", () => {
+  it("passes through requests with no MongoDB connection URIs", async () => {
+    const req = createConversationsMiddlewareReq();
+    const res = createConversationsMiddlewareRes();
+    const next = jest.fn();
+
+    const middleware = redactConnectionUri();
+    req.body = {
+      message: "This is a normal message without any connection URI",
+    };
+    req.params = baseReq.params;
+    req.query = baseReq.query;
+    req.headers = baseReq.headers;
+
+    await middleware(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect((req.body as { message: string }).message).toBe(
+      "This is a normal message without any connection URI"
+    );
+  });
+
+  it("redacts MongoDB connection URIs in message", async () => {
+    const req = createConversationsMiddlewareReq();
+    const res = createConversationsMiddlewareRes();
+    const next = jest.fn();
+
+    const middleware = redactConnectionUri();
+    const messageWithUri =
+      "I'm using this connection string: mongodb://user123:password456@localhost:27017/mydb";
+    req.body = { message: messageWithUri };
+    req.params = baseReq.params;
+    req.query = baseReq.query;
+    req.headers = baseReq.headers;
+
+    await middleware(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect((req.body as { message: string }).message).toBe(
+      "I'm using this connection string: mongodb://<USERNAME>:<PASSWORD>@localhost:27017/mydb"
+    );
+    expect((req.body as { message: string }).message).not.toContain("user123");
+    expect((req.body as { message: string }).message).not.toContain(
+      "password456"
+    );
+  });
+
+  it("redacts multiple MongoDB connection URIs in message", async () => {
+    const req = createConversationsMiddlewareReq();
+    const res = createConversationsMiddlewareRes();
+    const next = jest.fn();
+
+    const middleware = redactConnectionUri();
+    const messageWithUris =
+      "I have two connection strings: " +
+      "mongodb://user1:pass1@localhost:27017/db1 and " +
+      "mongodb+srv://user2:pass2@cluster0.mongodb.net/db2";
+    req.body = { message: messageWithUris };
+    req.params = baseReq.params;
+    req.query = baseReq.query;
+    req.headers = baseReq.headers;
+
+    await middleware(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect((req.body as { message: string }).message).toBe(
+      "I have two connection strings: " +
+        "mongodb://<USERNAME>:<PASSWORD>@localhost:27017/db1 and " +
+        "mongodb+srv://<USERNAME>:<PASSWORD>@cluster0.mongodb.net/db2"
+    );
+    expect((req.body as { message: string }).message).not.toContain("user1");
+    expect((req.body as { message: string }).message).not.toContain("pass1");
+    expect((req.body as { message: string }).message).not.toContain("user2");
+    expect((req.body as { message: string }).message).not.toContain("pass2");
+  });
+
+  it("handles requests with no body", async () => {
+    const req = createConversationsMiddlewareReq();
+    const res = createConversationsMiddlewareRes();
+    const next = jest.fn();
+
+    const middleware = redactConnectionUri();
+    req.body = undefined;
+    req.params = baseReq.params;
+    req.query = baseReq.query;
+    req.headers = baseReq.headers;
+
+    await middleware(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it("handles requests with no message", async () => {
+    const req = createConversationsMiddlewareReq();
+    const res = createConversationsMiddlewareRes();
+    const next = jest.fn();
+
+    const middleware = redactConnectionUri();
+    req.body = { someOtherField: "value" };
+    req.params = baseReq.params;
+    req.query = baseReq.query;
+    req.headers = baseReq.headers;
+
+    await middleware(req, res, next);
+
+    expect(next).toHaveBeenCalledTimes(1);
+    expect((req.body as { someOtherField: string }).someOtherField).toBe(
+      "value"
+    );
+  });
+});

packages/chatbot-server-mongodb-public/src/middleware/redactConnectionUri.ts

@@ -0,0 +1,34 @@
+import { ConversationsMiddleware } from "mongodb-chatbot-server";
+import { getRequestId, logRequest } from "../utils";
+import { redactMongoDbConnectionUri } from "mongodb-rag-core/executeCode";
+
+/**
+  Middleware that redacts MongoDB connection URIs in request bodies to prevent
+  sensitive information from being logged or stored.
+
+  This middleware looks for MongoDB connection URIs in the request body and
+  replaces the username and password with placeholders.
+ */
+export function redactConnectionUri(): ConversationsMiddleware {
+  return (req, res, next) => {
+    const reqId = getRequestId(req);
+
+    // Skip if there's no body
+    if (!req.body) {
+      next();
+      return;
+    }
+
+    // Process the message for addMessageToConversations if it exists
+    if (req.body.message && typeof req.body.message === "string") {
+      req.body.message = redactMongoDbConnectionUri(req.body.message);
+    }
+
+    logRequest({
+      reqId,
+      message: "Redacted MongoDB connection URIs in request body",
+    });
+
+    next();
+  };
+}