{"record":{"id":"4b5954c39eae448f","repo":"shadow1ng/fscan","slug":"w-v","errorCode":null,"errorMessage":"%w: %v","messagePattern":"%w: %v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":1523,"sourceCode":"\t\t}\n\t\ts.putKeyValString(kv.key, kv.val, kv.flag)\n\t}\n\tif err := s.writeData(); err != nil {\n\t\treturn err\n\t}\n\tfor {\n\t\tmsg, err := s.getByte()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := s.readMsg(msg); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif msg == 4 || msg == 9 {\n\t\t\tif s.hasError() {\n\t\t\t\terr := s.oracleError()\n\t\t\t\tif classifyOracleErrorType(err) == ErrorTypeAuth {\n\t\t\t\t\treturn fmt.Errorf(\"%w: %v\", errOracleAuthFailed, err)\n\t\t\t\t}\n\t\t\t\treturn err\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\t}\n}\n\nfunc oracleAlterSession() string {\n\t_, offset := time.Now().Zone()\n\thours := int8(offset / 3600)\n\tminutes := int8((offset / 60) % 60)\n\tif minutes < 0 {\n\t\tminutes = -minutes\n\t}\n\ttz := fmt.Sprintf(\"%+03d:%02d\", hours, minutes)\n\treturn fmt.Sprintf(\"ALTER SESSION SET NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA'  TIME_ZONE='%s'\\x00\", tz)\n}","sourceCodeStart":1505,"sourceCodeEnd":1541,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L1505-L1541","documentation":"This is a wrapped error: when the server replies with TTC message 4 or 9 carrying an error, and the classified error type is authentication, the library wraps the server's ORA- error with errOracleAuthFailed using %w so errors.Is(err, errOracleAuthFailed) works. The final message looks like 'oracle authentication failed: ORA-01017: invalid username/password'.","triggerScenarios":"oracleRawAuth processes a server response message 4 (error) or 9, s.hasError() is true, and classifyOracleErrorType maps the extracted ORA- error to ErrorTypeAuth (e.g. ORA-01017 invalid username/password, ORA-28000 account locked).","commonSituations":"Wrong username/password in the DSN; password expired (ORA-28001) or account locked (ORA-28000); connecting to a CDB/PDB with wrong common-user prefix; credentials rotated in a secret store but not updated in the app config.","solutions":["Read the wrapped ORA- error (%v part) and fix the root cause — most commonly ORA-01017: verify username/password.","Check account status: SELECT account_status FROM dba_users WHERE username='...'; unlock or reset if LOCKED/EXPIRED.","In code, use errors.Is(err, errOracleAuthFailed) to branch to credential-renewal logic (e.g. re-fetch secrets) rather than retrying blindly."],"exampleFix":"// before\nerr := db.Connect(dsn) // panic/log generic\n// after\nif err := db.Connect(dsn); err != nil {\n    if errors.Is(err, errOracleAuthFailed) {\n        creds := refreshCredentials() // rotate/re-fetch\n        dsn = buildDSN(creds)\n    }\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := connectAuth(ctx, cfg)\nif errors.Is(err, errOracleAuthFailed) {\n    creds := rotateOrRefetchCredentials()\n    return retryAuth(ctx, cfg.WithCredentials(creds))\n}\nif err != nil { return err }","preventionTips":["Store credentials in a secret manager and refresh them on auth failure","Monitor account_status in dba_users for locks/expiry","Never hardcode passwords in DSNs committed to source control"],"tags":["oracle","authentication","credentials","error-wrapping"],"backgroundTag":"authentication-required","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}