projectdiscovery/nuclei · error

oracle %s %q: %w

Error message

oracle %s %q: %w

What it means

Thrown while sandboxing an Oracle DSN: query parameters named 'trace file', 'trace dir', 'trace folder', or 'trace directory' (case-insensitive) are rewritten through protocolstate.NormalizePathWithExecutionId, which restricts file access to the nuclei-templates directory unless local file access is enabled. The %s is the option key, %q its value, and the wrapped error explains the underlying rejection (path unresolvable, or outside the allowed template directory). This is nuclei's sandbox preventing JS templates from writing trace/log files to arbitrary paths.

Source

Thrown at pkg/js/libs/oracle/oracle.go:128

func sandboxDSN(executionId string, dsn string) (string, error) {
	parsed, err := url.Parse(dsn)
	if err != nil {
		return "", err
	}

	query := parsed.Query()
	changed := false
	for key, values := range query {
		if !isOracleTracePathOption(key) {
			continue
		}
		for i, value := range values {
			if value == "" {
				continue
			}
			normalized, err := protocolstate.NormalizePathWithExecutionId(executionId, value)
			if err != nil {
				return "", fmt.Errorf("oracle %s %q: %w", key, value, err)
			}
			values[i] = normalized
		}
		query[key] = values
		changed = true
	}
	if !changed {
		return dsn, nil
	}

	parsed.RawQuery = query.Encode()
	return parsed.String(), nil
}

func isOracleTracePathOption(key string) bool {
	switch strings.ToUpper(strings.TrimSpace(key)) {
	case "TRACE FILE", "TRACE DIR", "TRACE FOLDER", "TRACE DIRECTORY":
		return true

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Remove the trace file/dir/folder/directory query parameters from the DSN — tracing is a debug aid, not needed for queries
2. Point the trace option at a path inside the nuclei-templates directory (config.DefaultConfig.GetTemplateDir())
3. Run nuclei with -lfa / AllowLocalFileAccess=true only if you fully control the templates and the trace location is trusted
4. If you need the wrapped cause, inspect the %w chain: 'could not resolve and clean path' vs path-outside-sandbox

Example fix

// before
const dsn = 'oracle://user:pass@acme.com:1521/XE?trace file=/tmp/trace.log';
client.ConnectWithDSN(dsn); // oracle trace file "/tmp/trace.log": ...

// after
const dsn = 'oracle://user:pass@acme.com:1521/XE';
client.ConnectWithDSN(dsn);

// strip sandboxed trace options before handing a DSN to the oracle client
function sanitizeOracleDsn(dsn) {
  return dsn.replace(/([?&])(trace[+ ]?(file|dir|folder|directory)=[^&]*)/ig, '');
}

function hasOracleTraceOption(dsn) {
  return /[?&]trace[+ ]?(file|dir|folder|directory)=/i.test(dsn);
}

try { client.ConnectWithDSN(dsn); }
catch (e) {
  if (/oracle trace (file|dir|folder|directory)/i.test(String(e))) { /* retry with trace params removed */ }
  else { throw e; }
}

When it happens

Trigger: Calling oracle.ConnectWithDSN / ExecuteQueryWithDSN with a DSN like `oracle://user:pass@host:1521/XE?trace file=/tmp/trace.log` when /tmp is outside the nuclei-templates directory and AllowLocalFileAccess is false. Also fires when the trace path cannot be resolved/cleaned at all (missing directory, invalid path).

Common situations: Templates copied from go-ora documentation that enable tracing for debugging; CI runs where the templates dir differs from the trace target; hardened scans with -lfa disabled (the default posture); DSNs built from user input containing absolute paths.

Related errors

• protoset path denied: %w
• path %v is outside nuclei-template directory and -allow-loca
• invalid host or port
• dialers not initialized for %s
• invalid host or port

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/77badc7c4c84fd34. Report an issue: GitHub.