fix: never allow literal unescaped @ as part of usernames COMPASS-5958 (#23)

Author: addaleax

package.json

@@ -52,8 +52,8 @@
     "gen-esm-wrapper": "^1.1.3",
     "mocha": "^8.1.3",
     "nyc": "^15.1.0",
-    "ts-node": "^9.0.0",
-    "typescript": "^4.0.3"
+    "ts-node": "^10.9.1",
+    "typescript": "^4.7.4"
   },
   "dependencies": {
     "@types/whatwg-url": "^8.2.1",

src/index.ts

@@ -18,7 +18,7 @@ function connectionStringHasValidScheme(connectionString: string) {
 // Adapted from the Node.js driver code:
 // https://github.com/mongodb/node-mongodb-native/blob/350d14fde5b24480403313cfe5044f6e4b25f6c9/src/connection_string.ts#L146-L206
 const HOSTS_REGEX =
-  /^(?<protocol>[^/]+):\/\/(?:(?<username>[^:]*)(?::(?<password>[^@]*))?@)?(?<hosts>(?!:)[^/?@]*)(?<rest>.*)/;
+  /^(?<protocol>[^/]+):\/\/(?:(?<username>[^:@]*)(?::(?<password>[^@]*))?@)?(?<hosts>(?!:)[^/?@]*)(?<rest>.*)/;
 
 class CaseInsensitiveMap<K extends string = string> extends Map<K, string> {
   delete(name: K): boolean {

test/index.ts

@@ -73,6 +73,20 @@ describe('ConnectionString', () => {
           isSRV: false,
           hosts: ['localhost:12345', 'anotherHost']
         }
+      },
+      {
+        uri: 'mongodb://database-meow@database-haha.mongo.blah.blah.com:8888/?ssl=true&replicaSet=globaldb&retrywrites=false&maxIdleTimeMS=120000&appName=@database-haha@',
+        match: {
+          href: 'mongodb://database-meow@database-haha.mongo.blah.blah.com:8888/?ssl=true&replicaSet=globaldb&retrywrites=false&maxIdleTimeMS=120000&appName=@database-haha@',
+          protocol: 'mongodb:',
+          username: 'database-meow',
+          password: '',
+          pathname: '/',
+          search: '?ssl=true&replicaSet=globaldb&retrywrites=false&maxIdleTimeMS=120000&appName=@database-haha@',
+          hash: '',
+          isSRV: false,
+          hosts: ['database-haha.mongo.blah.blah.com:8888']
+        }
       }
     ]) {
       it(`parses ${uri} correctly`, () => {