{"record":{"id":"77badc7c4c84fd34","repo":"projectdiscovery/nuclei","slug":"oracle-s-q-w","errorCode":null,"errorMessage":"oracle %s %q: %w","messagePattern":"oracle (.+?) %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/oracle/oracle.go","lineNumber":128,"sourceCode":"func sandboxDSN(executionId string, dsn string) (string, error) {\n\tparsed, err := url.Parse(dsn)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tquery := parsed.Query()\n\tchanged := false\n\tfor key, values := range query {\n\t\tif !isOracleTracePathOption(key) {\n\t\t\tcontinue\n\t\t}\n\t\tfor i, value := range values {\n\t\t\tif value == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tnormalized, err := protocolstate.NormalizePathWithExecutionId(executionId, value)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"oracle %s %q: %w\", key, value, err)\n\t\t\t}\n\t\t\tvalues[i] = normalized\n\t\t}\n\t\tquery[key] = values\n\t\tchanged = true\n\t}\n\tif !changed {\n\t\treturn dsn, nil\n\t}\n\n\tparsed.RawQuery = query.Encode()\n\treturn parsed.String(), nil\n}\n\nfunc isOracleTracePathOption(key string) bool {\n\tswitch strings.ToUpper(strings.TrimSpace(key)) {\n\tcase \"TRACE FILE\", \"TRACE DIR\", \"TRACE FOLDER\", \"TRACE DIRECTORY\":\n\t\treturn true","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/oracle/oracle.go#L110-L146","documentation":"Thrown while sandboxing an Oracle DSN: query parameters named 'trace file', 'trace dir', 'trace folder', or 'trace directory' (case-insensitive) are rewritten through protocolstate.NormalizePathWithExecutionId, which restricts file access to the nuclei-templates directory unless local file access is enabled. The %s is the option key, %q its value, and the wrapped error explains the underlying rejection (path unresolvable, or outside the allowed template directory). This is nuclei's sandbox preventing JS templates from writing trace/log files to arbitrary paths.","triggerScenarios":"Calling oracle.ConnectWithDSN / ExecuteQueryWithDSN with a DSN like `oracle://user:pass@host:1521/XE?trace file=/tmp/trace.log` when /tmp is outside the nuclei-templates directory and AllowLocalFileAccess is false. Also fires when the trace path cannot be resolved/cleaned at all (missing directory, invalid path).","commonSituations":"Templates copied from go-ora documentation that enable tracing for debugging; CI runs where the templates dir differs from the trace target; hardened scans with -lfa disabled (the default posture); DSNs built from user input containing absolute paths.","solutions":["Remove the trace file/dir/folder/directory query parameters from the DSN — tracing is a debug aid, not needed for queries","Point the trace option at a path inside the nuclei-templates directory (config.DefaultConfig.GetTemplateDir())","Run nuclei with -lfa / AllowLocalFileAccess=true only if you fully control the templates and the trace location is trusted","If you need the wrapped cause, inspect the %w chain: 'could not resolve and clean path' vs path-outside-sandbox"],"exampleFix":"// before\nconst dsn = 'oracle://user:pass@acme.com:1521/XE?trace file=/tmp/trace.log';\nclient.ConnectWithDSN(dsn); // oracle trace file \"/tmp/trace.log\": ...\n\n// after\nconst dsn = 'oracle://user:pass@acme.com:1521/XE';\nclient.ConnectWithDSN(dsn);","handlingStrategy":"validation","validationCode":"// strip sandboxed trace options before handing a DSN to the oracle client\nfunction sanitizeOracleDsn(dsn) {\n  return dsn.replace(/([?&])(trace[+ ]?(file|dir|folder|directory)=[^&]*)/ig, '');\n}","typeGuard":"function hasOracleTraceOption(dsn) {\n  return /[?&]trace[+ ]?(file|dir|folder|directory)=/i.test(dsn);\n}","tryCatchPattern":"try { client.ConnectWithDSN(dsn); }\ncatch (e) {\n  if (/oracle trace (file|dir|folder|directory)/i.test(String(e))) { /* retry with trace params removed */ }\n  else { throw e; }\n}","preventionTips":["Omit trace file/dir/folder/directory options from production DSNs","If tracing is needed, target a path inside the nuclei-templates dir","Enable -lfa only with trusted templates and explicit trace paths","Parse the %w tail to distinguish unresolvable paths from sandbox rejections"],"tags":["oracle","dsn","sandbox","file-access"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}