RUBY-3832 Raise on invalid tls/ssl boolean URI option

[comandeo-mongo]

What

An invalid value for the tls or ssl URI option (a typo such as tls=yes, tls=1, tls=on) was warned about and discarded, leaving :ssl as nil. Address::IPv4#socket evaluates if options[:ssl], so nil is falsy and the driver opened a plaintext TCP socket. Against a server that does not enforce TLS server-side, the application connected successfully over plaintext with only a log line — credentials and traffic exposed. (RUBY-3832)

This now raises Mongo::Error::InvalidURI instead of silently downgrading.

How

• OptionsMapper#convert_repeated_bool (used only by tls/ssl) preserves an invalid value as a nil element rather than warning and dropping it.
• URI#validate_uri_options! raises Mongo::Error::InvalidURI when the parsed tls/ssl value contains a nil, alongside the existing tls/ssl conflict checks.

Scope decision

Limited to tls and ssl — the only boolean options that fail open (to plaintext). The other TLS boolean options keep the lenient warn-and-default behavior because:

1. They fail secure on an invalid value (tlsInsecure, tlsAllowInvalidCertificates, tlsAllowInvalidHostnames, tlsDisableOCSPEndpointCheck invalid → nil → secure default, verification stays on).
2. The upstream unified spec fixtures (uri-options/tests/tls-options.yml) explicitly assert valid: true, warning: true for invalid tlsAllowInvalidCertificates/tlsAllowInvalidHostnames/tlsInsecure. Raising for those would diverge from the spec tests. There is no upstream fixture for invalid tls/ssl, so raising there is spec-safe.

Python and Go also raise on invalid tls/ssl; pymongo achieves the spec-test warnings via a separate warn=True mode, which the Ruby driver does not have.

Breaking change

Applications currently passing invalid TLS boolean values (tls=yes, etc.) connect over plaintext today while believing they have TLS. They will now fail fast at URI parse time. This surfaces a pre-existing misconfiguration; it does not introduce a new failure mode.

Files changed

• lib/mongo/uri/options_mapper.rb — convert_repeated_bool preserves invalid value as nil
• lib/mongo/uri.rb — validate_uri_options! raises on invalid tls/ssl
• spec/mongo/uri_option_parsing_spec.rb — new 'a strict boolean option' shared example covering tls/ssl

Test plan

• bundle exec rspec spec/mongo/uri_option_parsing_spec.rb spec/mongo/uri_spec.rb spec/spec_tests/uri_options_spec.rb — 730 examples, 0 failures (inverse_bool warn fixtures still pass)
• bundle exec rspec spec/integration/ssl_uri_options_spec.rb — passes
• bundle exec rubocop on changed files — no offenses
• Manual: tls=yes raises InvalidURI; tls=true/false and absent parse as before; tlsInsecure=foo still warns + secure default

RUBY-3832

[Copilot]

Pull request overview

This PR hardens MongoDB URI parsing by refusing invalid tls/ssl boolean values (e.g., tls=yes) that previously resulted in :ssl being unset and the driver potentially connecting over plaintext. It raises Mongo::Error::InvalidURI during URI parsing instead of warning and silently downgrading.

Changes:

• Preserve invalid tls/ssl values as nil sentinels during repeated-boolean conversion so they can be detected later.
• Add URI validation to raise InvalidURI when parsed tls/ssl values contain an invalid element (nil).
• Add a shared spec ('a strict boolean option') and apply it to tls and ssl.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
lib/mongo/uri/options_mapper.rb	Adjusts repeated-boolean parsing for tls/ssl to preserve invalid values as nil for downstream validation.
lib/mongo/uri.rb	Raises InvalidURI when tls/ssl contains invalid boolean values, preventing silent plaintext fallback.
spec/mongo/uri_option_parsing_spec.rb	Adds/uses a strict boolean shared example to assert invalid tls/ssl values raise parse errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.