require-tls-connection

⚠️ This rule warns by default in the recommended config.

Quick SummaryCopy Anchor Link

Rule DetailsCopy Anchor Link

MongoDB connections without TLS are vulnerable to:

• Man-in-the-Middle (MitM) attacks
• Credential interception
• Data exfiltration during transit

❌ IncorrectCopy Anchor Link

// No TLS enabled
mongoose.connect('mongodb://localhost:27017/db');

// Explicit TLS disabled
mongoose.connect(uri, { tls: false });

// Legacy ssl option disabled
mongoose.connect(uri, { ssl: false });

✅ CorrectCopy Anchor Link

// TLS enabled in the options
mongoose.connect(uri, { tls: true });

// mongodb+srv:// turns TLS on by default
mongoose.connect('mongodb+srv://cluster0.example.mongodb.net/app');

// TLS enabled in the connection string
mongoose.connect('mongodb://db.example.com/app?tls=true');

A tls=false / ssl=false in the connection string, or tls: false in the options, turns the +srv default back off and is reported.

Receiver RequirementCopy Anchor Link

A .connect() is not evidence of MongoDB. Redis clients, TypeORM query runners and pino transports all have one, and naming another database's connection "MongoDB" is worse than staying silent. This rule only fires when the receiver is bound to a mongodb/mongoose import, is a new MongoClient(...), or is named mongo*.

// ✅ Not reported — Redis
const client = createClient({ url: REDIS_URL });
await client.connect();

// ✅ Not reported — TypeORM
const queryRunner = this.repository.manager.connection.createQueryRunner();
await queryRunner.connect();

allowInTests (on by default) also covers files under test/, tests/, __tests__/, __mocks__/, e2e/ and fixtures/ directories, not just *.test.ts / *.spec.ts — testcontainers helpers are not production connections.

Known False PositivesCopy Anchor Link

Local DevelopmentCopy Anchor Link

// FP: Intentionally no TLS for local dev
mongoose.connect('mongodb://localhost:27017/devdb');

Workaround: Use allowInTests: true or configure environment-specific rules.

Known False NegativesCopy Anchor Link

Dynamic ConfigurationCopy Anchor Link

// ❌ NOT DETECTED
const options = getConfig();
mongoose.connect(uri, options); // TLS may or may not be enabled

When Not To Use ItCopy Anchor Link

• Local development with Docker containers
• Test environments with ephemeral databases
• Environments where TLS is handled at network level (VPC, SSH tunnel)

ReferencesCopy Anchor Link

• MongoDB TLS/SSL Configuration
• CWE-295

⚙️ OptionsCopy Anchor Link

Use this rule

npm install -D oxlint-plugin-mongodb-security

{  "jsPlugins": ["oxlint-plugin-mongodb-security"],  "rules": {    "mongodb-security/require-tls-connection": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-mongodb-security'],    rules: {      'mongodb-security/require-tls-connection': 'error',    },  },});