1 files changed, 26 insertions, 2 deletions
diff --git a/src/mongo/client/cyrus_sasl_client_session.cpp b/src/mongo/client/cyrus_sasl_client_session.cpp
index 84ae1ab0b5a..2bca7e1b1de 100644
--- a/src/mongo/client/cyrus_sasl_client_session.cpp
+++ b/src/mongo/client/cyrus_sasl_client_session.cpp
@@ -47,7 +47,8 @@ void saslSetError(sasl_conn_t* conn, const std::string& msg) {
 }
 
 SaslClientSession* createCyrusSaslClientSession(const std::string& mech) {
-    if ((mech == "SCRAM-SHA-1") || (mech == "SCRAM-SHA-256") || mech == "MONGODB-AWS") {
+    if ((mech == "SCRAM-SHA-1") || (mech == "SCRAM-SHA-256") || (mech == "PLAIN") ||
+        mech == "MONGODB-AWS") {
         return new NativeSaslClientSession();
     }
     return new CyrusSaslClientSession();
@@ -121,6 +122,28 @@ int saslClientLogSwallow(void* context, int priority, const char* message) throw
 }
 
 /**
+ * Implements the Cyrus SASL default_verifyfile_cb interface registered in the
+ * Cyrus SASL library to verify, and then accept or reject, the loading of
+ * plugin libraries from the target directory.
+ *
+ * On Windows environments, disable loading of plugin files.
+ */
+int saslClientVerifyPluginFile(void*, const char*, sasl_verify_type_t type) {
+
+    if (type != SASL_VRFY_PLUGIN) {
+        return SASL_OK;
+    }
+
+#ifdef _WIN32
+    return SASL_CONTINUE;  // A non-SASL_OK response indicates to Cyrus SASL that it
+                           // should not load a file. This effectively disables
+                           // loading plugins from path on Windows.
+#else
+    return SASL_OK;
+#endif
+}
+
+/**
  * Initializes the client half of the SASL library, but is effectively a no-op if the client
  * application has already done it.
  *
@@ -136,6 +159,7 @@ MONGO_INITIALIZER_WITH_PREREQUISITES(CyrusSaslClientContext,
 (InitializerContext* context) {
     static sasl_callback_t saslClientGlobalCallbacks[] = {
         {SASL_CB_LOG, SaslCallbackFn(saslClientLogSwallow), nullptr /* context */},
+        {SASL_CB_VERIFYFILE, SaslCallbackFn(saslClientVerifyPluginFile), nullptr /*context*/},
         {SASL_CB_LIST_END}};
 
     // If the client application has previously called sasl_client_init(), the callbacks passed
@@ -240,7 +264,7 @@ void CyrusSaslClientSession::setParameter(Parameter id, StringData value) {
         _secret.reset(new char[sizeof(sasl_secret_t) + value.size() + 1]);
         sasl_secret_t* secret = static_cast<sasl_secret_t*>(static_cast<void*>(_secret.get()));
         secret->len = value.size();
-        value.copyTo(static_cast<char*>(static_cast<void*>(&secret->data[0])), false);
+        value.copy(static_cast<char*>(static_cast<void*>(&secret->data[0])), value.size());
     }
     SaslClientSession::setParameter(id, value);
 }