{"record":{"id":"8f05aac0e11841fe","repo":"projectdiscovery/nuclei","slug":"invalid-host-or-port-8f05aa","errorCode":null,"errorMessage":"invalid host or port","messagePattern":"invalid host or port","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/oracle/oracle.go","lineNumber":201,"sourceCode":"\tif err != nil {\n\t\treturn false, err\n\t}\n\n\treturn true, nil\n}\n\n// ExecuteQuery connects to MS SQL database using given credentials and executes a query.\n// It returns the results of the query or an error if something goes wrong.\n// @example\n// ```javascript\n// const oracle = require('nuclei/oracle');\n// const client = new oracle.OracleClient;\n// const result = client.ExecuteQuery('acme.com', 1521, 'username', 'password', 'XE', 'SELECT @@version');\n// log(to_json(result));\n// ```\nfunc (c *OracleClient) ExecuteQuery(ctx context.Context, host string, port int, username, password, dbName, query string) (*utils.SQLResult, error) {\n\tif host == \"\" || port <= 0 {\n\t\treturn nil, fmt.Errorf(\"invalid host or port\")\n\t}\n\n\tisOracleResp, err := c.IsOracle(ctx, host, port)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !isOracleResp.IsOracle {\n\t\treturn nil, fmt.Errorf(\"not a oracle service\")\n\t}\n\n\tconnStr := goora.BuildUrl(host, port, dbName, username, password, nil)\n\n\treturn c.ExecuteQueryWithDSN(ctx, connStr, query)\n}\n\n// ExecuteQueryWithDSN executes a query on an Oracle database using a DSN\n// @example\n// ```javascript","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/oracle/oracle.go#L183-L219","documentation":"Returned by OracleClient.ExecuteQuery as an input guard: host must be a non-empty string and port a positive integer before any probe or connection is attempted. Note the doc comment above it wrongly says 'MS SQL' — the check is for Oracle targets. It fires before IsOracle, so no network traffic happens when it triggers.","triggerScenarios":"Calling client.ExecuteQuery(host, port, ...) with host='' (e.g. an extractor produced an empty match) or port<=0 (unset variable, bad parse, 0 default). Passing a port as a string or letting JS coerce undefined to NaN→0 also lands here.","commonSituations":"Templates building arguments from extractor/variable output where a step produced nothing; copy-paste from docs with placeholders left; iterating service lists where some rows lack a port.","solutions":["Validate host is a non-empty string and port an integer in 1-65536 before calling ExecuteQuery","Default the port to 1521 when the template assumes Oracle but has no port data","Skip the target instead of calling when inputs are invalid","Log offending inputs to find which extractor produced the empty/zero value"],"exampleFix":"// before\nconst res = client.ExecuteQuery('', 0, 'user', 'pass', 'XE', 'SELECT * FROM v$version');\n\n// after\nif (host && port > 0) {\n  const res = client.ExecuteQuery(host, port, 'user', 'pass', 'XE', 'SELECT * FROM v$version');\n} else {\n  log('invalid target, skipping');\n}","handlingStrategy":"validation","validationCode":"if (typeof host !== 'string' || host.length === 0 || !Number.isInteger(port) || port <= 0 || port > 65535) {\n  throw new Error('valid host and port required');\n}\nclient.ExecuteQuery(host, port, user, pass, dbName, query);","typeGuard":"function isValidOracleTarget(host, port) {\n  return typeof host === 'string' && host.length > 0 && Number.isInteger(port) && port > 0 && port <= 65535;\n}","tryCatchPattern":"try { client.ExecuteQuery(host, port, user, pass, dbName, query); } catch (e) { if (String(e) === 'invalid host or port') { /* skip bad row */ } else { throw e; } }","preventionTips":["Validate host non-empty and port 1-65536 before every call","Default the port to 1521 when only host data is available","Skip rows with missing host/port instead of calling with garbage","Log the failing inputs to trace which extractor emitted empties"],"tags":["oracle","input-validation","network"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}