__dirname路径异常：MongoClient连接DocumentDB时路径前缀丢失疑问

问题现象 #

连接DocumentDB时，自动定位后端存储的TLS证书文件出现异常行为：

• 当路径指向真实存在的证书文件时，错误信息中的路径会丢失__dirname前缀
• 当路径指向不存在的文件时，错误信息中的路径会完整保留__dirname前缀

同时想了解这种证书路径写法的安全风险（当前项目非公开）。

相关代码 #

const client = new MongoClient(uri, {
  tlsCAFile: path.join(__dirname, process.env.TLSCAFILE), //Specify the DocDB cert
  tlsAllowInvalidCertificates: process.env.MODE !== "prod",
  tlsAllowInvalidHostnames: process.env.MODE !== "prod",
  directConnection: true,
  auth: {
      username: process.env.MONGODBUSER,
      password: process.env.MONGODBPASS
  }
});

错误信息对比 #

指向存在的文件时的ENOENT错误 #

Error: ENOENT: no such file or directory, open 'relative/path/to/key.pem'
    at async open (node:internal/fs/promises:639:25)
    at async Object.readFile (node:internal/fs/promises:1246:14)
    at async MongoClient._connect (/Users/<REDACTED>/node_modules/lib/mongo_client.js:163:32)
    at async MongoClient.connect (/Users/<REDACTED>/node_modules/mongodb/lib/mongo_client.js:142:13)
    at async MongoClient.connect (/Users/<REDACTED>/node_modules/mongodb/lib/mongo_client.js:295:16) {
  errno: -2,
  code: 'ENOENT',
  syscall: 'open',
  path: 'relative/path/to/key.pem' // 此处无__dirname前缀
}

指向不存在的文件时的ENOENT错误 #

Error: ENOENT: no such file or directory, open '/full/path/to/directory/relative/path/to/keythatisntthere.pem'
    at async open (node:internal/fs/promises:639:25)
    at async Object.readFile (node:internal/fs/promises:1246:14)
    at async MongoClient._connect (/Users/<REDACTED>/node_modules/lib/mongo_client.js:163:32)
    at async MongoClient.connect (/Users/<REDACTED>/node_modules/mongodb/lib/mongo_client.js:142:13)
    at async MongoClient.connect (/Users/<REDACTED>/node_modules/mongodb/lib/mongo_client.js:295:16) {
  errno: -2,
  code: 'ENOENT',
  syscall: 'open',
  path: '/full/path/to/directory/relative/path/to/keythatisntthere.pem' // 此处有完整__dirname前缀
}

补充尝试与验证 #

• console.log(path.join(__dirname, process.env.TLSCAFILE))输出的是正确的完整路径：/full/path/to/directory/relative/path/to/key.pem，怀疑该异常与MongoClient内部逻辑有关
• 尝试直接读取证书内容并通过ca参数传入，代码如下：

const q = (fs.readFileSync(path.join(__dirname, process.env.TLSCAFILE)));
const client = new MongoClient(uri, {
  ca: q,
  tlsAllowInvalidCertificates: process.env.MODE !== "prod",
  tlsAllowInvalidHostnames: process.env.MODE !== "prod",
  directConnection: true,
  auth: {
      username: process.env.MONGODBUSER,
      password: process.env.MONGODBPASS
  }
});

但依然出现完全相同的错误及堆栈信息。

安全风险说明 #

当前项目非公开的情况下，这种写法的风险相对可控，但仍需注意以下几点：

1. 证书文件权限：确保证书文件的权限设置严格（如仅允许运行该进程的用户拥有可读权限），避免被其他无关进程或用户读取
2. 环境变量防护：环境变量中的证书路径、数据库账号密码等敏感信息，需避免在日志中泄露，同时部署环境要限制环境变量的访问范围
3. 生产环境TLS验证：生产模式下必须关闭tlsAllowInvalidCertificates和tlsAllowInvalidHostnames，否则会面临中间人攻击的风险，开发环境临时关闭仅用于调试

内容的提问来源于stack exchange，提问作者S S