{"record":{"id":"d3508aba3570b6dc","repo":"projectdiscovery/nuclei","slug":"invalid-host-or-port-d3508a","errorCode":null,"errorMessage":"invalid host or port","messagePattern":"invalid host or port","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/mssql/mssql.go","lineNumber":61,"sourceCode":"// ConnectWithDB connects to MS SQL database using given credentials and database name.\n// If connection is successful, it returns true.\n// If connection is unsuccessful, it returns false and error.\n// The connection is closed after the function returns.\n// @example\n// ```javascript\n// const mssql = require('nuclei/mssql');\n// const client = new mssql.MSSQLClient;\n// const connected = client.ConnectWithDB('acme.com', 1433, 'username', 'password', 'master');\n// ```\nfunc (c *MSSQLClient) ConnectWithDB(ctx context.Context, host string, port int, username, password, dbName string) (bool, error) {\n\texecutionId := ctx.Value(\"executionId\").(string)\n\treturn memoizedconnect(ctx, executionId, host, port, username, password, dbName)\n}\n\n// @memo\nfunc connect(ctx context.Context, executionId string, host string, port int, username string, password string, dbName string) (bool, error) {\n\tif host == \"\" || port <= 0 {\n\t\treturn false, fmt.Errorf(\"invalid host or port\")\n\t}\n\tif !protocolstate.IsHostAllowed(executionId, host) {\n\t\t// host is not valid according to network policy\n\t\treturn false, protocolstate.ErrHostDenied.Msgf(host)\n\t}\n\n\ttarget := net.JoinHostPort(host, fmt.Sprintf(\"%d\", port))\n\n\tconnString := mssqlConnString(target, username, password, dbName)\n\n\tdb, err := sql.Open(\"sqlserver\", connString)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\tdefer func() {\n\t\t_ = db.Close()\n\t}()\n","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mssql/mssql.go#L43-L79","documentation":"Connect and ConnectWithDB validate their arguments before dialing: host must be non-empty and port strictly positive. This error is pure input validation — no network I/O has happened yet, and it is returned before the protocolstate host-allowlist check. Because the call goes through memoizedconnect, the failure is also memoized per template execution for the same arguments.","triggerScenarios":"Calling mssql.Connect / mssql.ConnectWithDB with an empty host string (e.g. an unparsed URL or missing template variable) or with port 0 / negative (e.g. a port variable that failed to parse and defaulted to 0).","commonSituations":"Nuclei JS templates where host comes from a dynamic extraction that returned empty; passing a port as a string or undefined so the runtime coerces to 0; iterating a target list that contains a bare path or scheme-only entry.","solutions":["Log or assert the host/port values right before the call in the template","Default the port explicitly: const p = port || 1433","Validate extracted variables before use (e.g. check host is non-empty and matches a hostname/IP regex)","If port comes from extraction, verify the regex captured digits only"],"exampleFix":"// before\nconst connected = client.ConnectWithDB(host, port, user, pass, 'master');\n\n// after\nif (!host || !(port > 0)) {\n  log('skipping target: invalid host/port');\n} else {\n  const connected = client.ConnectWithDB(host, port || 1433, user, pass, 'master');\n}","handlingStrategy":"validation","validationCode":"const valid = typeof host === 'string' && host.length > 0 && Number.isInteger(port) && port > 0;\nif (!valid) throw new Error('bad target: ' + host + ':' + port);","typeGuard":"function isValidMssqlTarget(host, port) {\n  return typeof host === 'string' && host.length > 0 && /^[a-zA-Z0-9._:-]+$/.test(host) &&\n         typeof port === 'number' && Number.isInteger(port) && port > 0 && port <= 65535;\n}","tryCatchPattern":"try { const ok = client.ConnectWithDB(host, port || 1433, user, pass, db); }\ncatch (e) { if (String(e).includes('invalid host or port')) log('skipping malformed target'); else throw e; }","preventionTips":["Default the port explicitly (port || 1433) in templates","Validate extracted host/port with a regex before any client call","Log raw extracted values once per run to catch collapsed variables"],"tags":["mssql","input-validation","javascript","nuclei-template","go"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}