Adding JS oracle client

[Mzack9999]

Proposed changes

Closes #4872

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• New Features

  • Added Oracle database support in JavaScript workflows, including authentication, connection, and query execution.
  • Enhanced Oracle service detection to validate endpoints before connecting.

• Tests

  • Introduced an integration test for Oracle authentication to ensure reliability and correctness.

• Chores

  • Updated dependencies to enable Oracle connectivity.

[coderabbitai]

Walkthrough

Adds Oracle support in JS libs with a new OracleClient (connect, query, driver integration via custom dialer), introduces a custom per-execution dialer with host-allow checks, updates go.mod with go-ora dependency, and adds an integration test that spins up Oracle XE and validates authentication via a new JavaScript protocol test.

Changes

Cohort / File(s)	Summary
Integration test: JavaScript Oracle auth cmd/integration-test/javascript.go	Adds Oracle XE dockertest resource, registers protocols/javascript/oracle-auth-test.yaml with a new javascriptOracleAuthTest executor, retries against container port 1521, and validates nuclei results; disabled on Windows/macOS.
Oracle JS client API pkg/js/libs/oracle/oracle.go	Introduces OracleClient with cached go-ora connector; migrates IsOracle to a method; adds Connect, ConnectWithDSN, ExecuteQuery, and ExecuteQueryWithDSN; integrates SQL open/ping, DSN building, and result unmarshalling.
Oracle custom dialer pkg/js/libs/oracle/oracledialer.go	Implements unexported custom dialer binding to executionId; enforces host allowlist via protocolstate; delegates dials to Fastdialer with context/timeout variants.
Dependency update go.mod	Adds github.com/sijms/go-ora/v2 v2.9.0.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant JS as JS Template
  participant OracleLib as OracleClient
  participant Dialer as oracleCustomDialer
  participant Fast as Fastdialer
  participant DB as Oracle DB

  JS->>OracleLib: Connect(host, port, service, user, pass)
  OracleLib->>Dialer: Open connector (custom dialer)
  Dialer->>Fast: DialContext(address)
  Fast->>DB: TCP connect 1521
  DB-->>Fast: Connection established
  OracleLib->>DB: SQL Ping (auth)
  DB-->>OracleLib: OK/Err
  OracleLib-->>JS: bool, error

Loading

sequenceDiagram
  autonumber
  participant Test as Integration Test
  participant Docker as Dockertest
  participant Nuclei as Nuclei Runner
  participant OracleXE as Oracle XE Container

  Test->>Docker: Run gvenzl/oracle-xe (1521)
  Docker-->>Test: Resource (port)
  Test->>Nuclei: Run protocols/javascript/oracle-auth-test.yaml
  Nuclei->>OracleXE: Connect/Ping via OracleClient
  OracleXE-->>Nuclei: Auth result
  Nuclei-->>Test: Results
  Test->>Docker: Purge/Expire resource

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Assessment against linked issues

Objective	Addressed	Explanation
Oracle brute/enum features (oracle-brute, oracle-brute-stealth, oracle-enum-users, oracle-sid-brute) [#4872]	❌	No brute-force or enumeration logic/templates added.
Oracle authentication capability (connect/ping/query support) [#4872]	✅

Assessment against linked issues: Out-of-scope changes

(No out-of-scope changes found.)

Poem

With whiskers twitching, I tap the keys—
A carrot-orange DSN hums with ease.
Through guarded burrows, the dialers run,
To Oracle warren on port one-five-two-one.
Tests hop green—what a tasty sight!
I thump: auth works. Now moonlit byte. 🥕✨

Tip

🔌 Remote MCP (Model Context Protocol) integration is now available!

Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats.

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat-4872-oracle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 7

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/js/libs/oracle/oracle.go (1)

58-84: Harden detection: policy check, timed dial, and banner overwrite bug

• Enforce network policy via IsHostAllowed before dialing.
• Use a timeout context for Dial instead of context.TODO().
• Fix double assignment that overwrites the banner; safely read metadata.

-	timeout := 5 * time.Second
-	conn, err := dialer.Fastdialer.Dial(context.TODO(), "tcp", net.JoinHostPort(host, strconv.Itoa(port)))
+	timeout := 5 * time.Second
+	address := net.JoinHostPort(host, strconv.Itoa(port))
+	if !protocolstate.IsHostAllowed(executionId, address) {
+		return resp, protocolstate.ErrHostDenied.Msgf(address)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	conn, err := dialer.Fastdialer.Dial(ctx, "tcp", address)
@@
-	resp.Banner = service.Version
-	resp.Banner = service.Metadata().(plugins.ServiceOracle).Info
+	resp.Banner = service.Version
+	if meta, ok := service.Metadata().(plugins.ServiceOracle); ok && meta.Info != "" {
+		resp.Banner = fmt.Sprintf("%s %s", service.Version, meta.Info)
+	}

🧹 Nitpick comments (5)

pkg/js/libs/oracle/oracledialer.go (1)

29-31: Prefer Background over TODO for default Dial context

Minor: use context.Background() for neutrality and to match DialTimeout’s approach.

 func (o *oracleCustomDialer) Dial(network, address string) (net.Conn, error) {
-	return o.dialWithCtx(context.TODO(), network, address)
+	return o.dialWithCtx(context.Background(), network, address)
 }

cmd/integration-test/javascript.go (1)

201-219: Increase Oracle XE startup window

Bump expiry to accommodate slow cold starts as above. Otherwise test intermittently fails on CI.

pkg/js/libs/oracle/oracle.go (3)

45-49: Update example to method-based API and consistent helper name

Change to instantiate OracleClient, and use to_json consistently.

-// const oracle = require('nuclei/oracle');
-// const isOracle = oracle.IsOracle('acme.com', 1521);
-// log(toJSON(isOracle));
+// const oracle = require('nuclei/oracle');
+// const client = new oracle.OracleClient();
+// const isOracle = client.IsOracle('acme.com', 1521);
+// log(to_json(isOracle));

---

112-115: Fix example syntax

Missing constructor parentheses.

-// const client = new oracle.OracleClient;
+// const client = new oracle.OracleClient();

---

156-172: Grammar and clarity

Minor message tweak.

-		return nil, fmt.Errorf("not a oracle service")
+		return nil, fmt.Errorf("not an Oracle service")

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 8194fab and 8a96eb2.

⛔ Files ignored due to path filters (4)

• go.sum is excluded by !**/*.sum
• pkg/js/generated/go/liboracle/oracle.go is excluded by !**/generated/**
• pkg/js/generated/ts/oracle.ts is excluded by !**/generated/**
• pkg/protocols/javascript/testcases/oracle-auth-test.yaml is excluded by !**/*.yaml

📒 Files selected for processing (4)

• cmd/integration-test/javascript.go (3 hunks)
• go.mod (1 hunks)
• pkg/js/libs/oracle/oracle.go (4 hunks)
• pkg/js/libs/oracle/oracledialer.go (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (3)

pkg/js/libs/oracle/oracledialer.go (2)

pkg/protocols/common/protocolstate/state.go (1)

• GetDialersWithId (39-45)

pkg/protocols/common/protocolstate/headless.go (2)

• IsHostAllowed (124-150)
• ErrHostDenied (22-22)

cmd/integration-test/javascript.go (1)

pkg/testutils/integration.go (2)

• TestCase (247-250)
• RunNucleiTemplateAndGetResults (30-32)

pkg/js/libs/oracle/oracle.go (2)

pkg/js/generated/ts/oracle.ts (8)

• OracleClient (27-97)
• IsOracle (65-67)
• IsOracleResponse (13-16)
• Connect (40-42)
• ConnectWithDSN (53-55)
• ExecuteQuery (80-82)
• SQLResult (102-106)
• ExecuteQueryWithDSN (94-96)

pkg/js/utils/util.go (1)

• UnmarshalSQLRows (23-90)

🔇 Additional comments (5)

go.mod (1)

113-113: Add go-ora/v2 dependency — OK

Pinning github.com/sijms/go-ora/v2 v2.9.0 looks good and aligns with the new Oracle client.

pkg/js/libs/oracle/oracledialer.go (1)

17-27: Good: per-execution dialer with network-policy enforcement

Uses protocolstate to bind to the correct dialer and deny disallowed hosts before dialing.

cmd/integration-test/javascript.go (2)

18-19: Test registration — OK

Oracle JS auth test correctly disabled on Windows/macOS.

---

22-26: Resource wiring — OK

Adds oracleResource alongside existing resources.

pkg/js/libs/oracle/oracle.go (1)

197-205: Verify utils.UnmarshalSQLRows handles Oracle types

Current switch maps Postgres-like types; Oracle returns e.g., NUMBER, VARCHAR2, DATE, TIMESTAMP, RAW. Ensure mapping covers these; otherwise scans may fail or coerce to strings unexpectedly. I can raise a follow-up PR to extend type handling.

[coderabbitai]

⚠️ Potential issue

Fix retry logic, comment typo, and flakiness risk

• pool.Retry callback always returns nil, so it never retries; return err instead.
• Comment says “ssh server” in Oracle test.
• Oracle XE frequently needs >30s to become ready; current 30s expiry makes this flaky.

 func (j *javascriptOracleAuthTest) Execute(filePath string) error {
@@
-		_ = pool.Retry(func() error {
-			//let ssh server start
-			time.Sleep(3 * time.Second)
-			results, err = testutils.RunNucleiTemplateAndGetResults(filePath, finalURL, debug)
-			return nil
-		})
-		if err != nil {
-			return err
-		}
+		_ = pool.Retry(func() error {
+			// let oracle server start
+			time.Sleep(3 * time.Second)
+			results, err = testutils.RunNucleiTemplateAndGetResults(filePath, finalURL, debug)
+			return err
+		})
+		if err != nil {
+			return err
+		}

And extend the Oracle container expiry below to avoid premature teardown:

-	// by default expire after 30 sec
-	if err := oracleResource.Expire(30); err != nil {
+	// Oracle XE can take time to become ready
+	if err := oracleResource.Expire(600); err != nil {
 		log.Printf("Could not expire Oracle resource: %s", err)
 	}

[coderabbitai]

🛠️ Refactor suggestion

Fix driver documentation and prepare for safe connector caching

• The comment mentions oracle/godror but code uses go-ora. Update doc.
• To avoid reusing a connector across different DSNs/execution IDs, track DSN/execID with the connector.

-	// Client is a client for Oracle database.
-	// Internally client uses oracle/godror driver.
+	// Client is a client for Oracle database.
+	// Internally the client uses the go-ora driver (pure Go, no Oracle client needed).
@@
 type OracleClient struct {
-	connector *goora.OracleConnector
+	connector       *goora.OracleConnector
+	connectorDSN    string
+	connectorExecId string
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Client is a client for Oracle database.
	// Internally client uses oracle/godror driver.
	// @example
	// ```javascript
	// const oracle = require('nuclei/oracle');
	// const client = new oracle.OracleClient();
	// ```
	OracleClient struct {
	connector *goora.OracleConnector
	}
	// Client is a client for Oracle database.
	// Internally the client uses the go-ora driver (pure Go, no Oracle client needed).
	// @example
	//

🤖 Prompt for AI Agents

In pkg/js/libs/oracle/oracle.go around lines 30 to 39, update the doc comment to
reference the actual driver "go-ora" instead of "oracle/godror", and change the
OracleClient struct so the cached connector is associated with its DSN and
execution ID to prevent reuse across different connections; add two fields
(e.g., dsn string and execID string) alongside the existing connector
*goora.OracleConnector and ensure any connector-cache logic sets and checks
these fields before returning a cached connector.

[coderabbitai]

🛠️ Refactor suggestion

Avoid panic on missing executionId in context

Guard the cast; return a clear error when the context key is absent.

-func (c *OracleClient) IsOracle(ctx context.Context, host string, port int) (IsOracleResponse, error) {
-	executionId := ctx.Value("executionId").(string)
-	return memoizedisOracle(executionId, host, port)
-}
+func (c *OracleClient) IsOracle(ctx context.Context, host string, port int) (IsOracleResponse, error) {
+	execID, err := executionIDFromContext(ctx)
+	if err != nil {
+		return IsOracleResponse{}, err
+	}
+	return memoizedisOracle(execID, host, port)
+}

Add helper (outside this hunk):

// executionIDFromContext returns the executionId or an error if missing.
func executionIDFromContext(ctx context.Context) (string, error) {
	v := ctx.Value("executionId")
	if s, ok := v.(string); ok && s != "" {
		return s, nil
	}
	return "", fmt.Errorf("executionId missing in context")
}

🤖 Prompt for AI Agents

In pkg/js/libs/oracle/oracle.go around lines 49 to 52, the code directly
type-asserts ctx.Value("executionId").(string) which can panic if the key is
missing or not a string; add the provided executionIDFromContext helper outside
this hunk and replace the direct assertion with a call to that helper, returning
its error when executionId is missing so IsOracle returns a clear error instead
of panicking.

[coderabbitai]

🛠️ Refactor suggestion

Cache connector per DSN and executionId

Prevent accidental reuse across different connections.

 func (c *OracleClient) oracleDbInstance(connStr string, executionId string) (*goora.OracleConnector, error) {
-	if c.connector != nil {
+	if c.connector != nil && c.connectorDSN == connStr && c.connectorExecId == executionId {
 		return c.connector, nil
 	}
@@
 	oraConnector.Dialer(customDialer)
 
-	c.connector = oraConnector
+	c.connector = oraConnector
+	c.connectorDSN = connStr
+	c.connectorExecId = executionId
 
 	return oraConnector, nil
 }

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents

In pkg/js/libs/oracle/oracle.go around lines 86 to 107, the method currently
caches a single c.connector which allows accidental reuse across different DSNs
or executionIds; change the client to cache connectors per unique key (e.g.
connStr + ":" + executionId) instead of a single field: add a
map[string]*goora.OracleConnector (and a mutex if OracleClient is used
concurrently) to OracleClient, compute the key at function start, check the map
for an existing connector and return it if present, otherwise create the
connector, set the custom dialer, store it in the map under that key, and then
return it; ensure proper locking around map access and that each stored
connector is configured with its executionId-specific dialer.

[coderabbitai]

🛠️ Refactor suggestion

Use safe execID extraction and context-aware ping

Avoid panic on missing executionId; use PingContext.

-func (c *OracleClient) ConnectWithDSN(ctx context.Context, dsn string) (bool, error) {
-	executionId := ctx.Value("executionId").(string)
+func (c *OracleClient) ConnectWithDSN(ctx context.Context, dsn string) (bool, error) {
+	executionId, err := executionIDFromContext(ctx)
+	if err != nil {
+		return false, err
+	}
 
-	connector, err := c.oracleDbInstance(dsn, executionId)
+	connector, err := c.oracleDbInstance(dsn, executionId)
 	if err != nil {
 		return false, err
 	}
@@
-	// Test the connection
-	err = db.Ping()
+	// Test the connection
+	err = db.PingContext(ctx)

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents

In pkg/js/libs/oracle/oracle.go around lines 122 to 145, avoid panicking when
executionId is missing and make the connection test context-aware: first
retrieve executionId from ctx using a safe type assertion (v, ok :=
ctx.Value("executionId").(string)) and return a clear error if not present
instead of letting it panic; then replace db.Ping() with db.PingContext(ctx) so
the ping respects cancellation/deadlines; keep closing the DB in a defer and
propagate any ping error back to the caller.

[coderabbitai]

⚠️ Potential issue

Fix docs: database name, engine, and query

• Not MS SQL; it’s Oracle.
• Use a valid Oracle example query.

-// ExecuteQuery connects to MS SQL database using given credentials and executes a query.
+// ExecuteQuery connects to an Oracle database using given credentials and executes a query.
@@
-// const client = new oracle.OracleClient;
-// const result = client.ExecuteQuery('acme.com', 1521, 'username', 'password', 'XE', 'SELECT @@version');
+// const client = new oracle.OracleClient();
+// const result = client.ExecuteQuery('acme.com', 1521, 'username', 'password', 'XE', 'SELECT 1 FROM dual');

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// ExecuteQuery connects to MS SQL database using given credentials and executes a query.
	// It returns the results of the query or an error if something goes wrong.
	// @example
	// ```javascript
	// const oracle = require('nuclei/oracle');
	// const client = new oracle.OracleClient;
	// const result = client.ExecuteQuery('acme.com', 1521, 'username', 'password', 'XE', 'SELECT @@version');
	// log(to_json(result));
	// ```
	func (c *OracleClient) ExecuteQuery(ctx context.Context, host string, port int, username, password, dbName, query string) (*utils.SQLResult, error) {
	// ExecuteQuery connects to an Oracle database using given credentials and executes a query.
	// It returns the results of the query or an error if something goes wrong.
	// @example
	//

🤖 Prompt for AI Agents

In pkg/js/libs/oracle/oracle.go around lines 147 to 156, the function comment
incorrectly states "MS SQL" and uses an invalid example query; update the
docblock to reference Oracle (not MS SQL), clarify that dbName is the Oracle
SID/service name, and replace the example query with a valid Oracle query (e.g.
"SELECT * FROM dual" or another appropriate Oracle-specific statement); keep the
example code structure but change the descriptive text and query to match Oracle
semantics.

[coderabbitai]

🛠️ Refactor suggestion

Propagate context and avoid panic on executionId

Use helper, and run the query with context.

-func (c *OracleClient) ExecuteQueryWithDSN(ctx context.Context, dsn string, query string) (*utils.SQLResult, error) {
-	executionId := ctx.Value("executionId").(string)
+func (c *OracleClient) ExecuteQueryWithDSN(ctx context.Context, dsn string, query string) (*utils.SQLResult, error) {
+	executionId, err := executionIDFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
@@
-	rows, err := db.Query(query)
+	rows, err := db.QueryContext(ctx, query)

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	func (c *OracleClient) ExecuteQueryWithDSN(ctx context.Context, dsn string, query string) (*utils.SQLResult, error) {
	executionId := ctx.Value("executionId").(string)
	connector, err := c.oracleDbInstance(dsn, executionId)
	if err != nil {
	return nil, err
	}
	db := sql.OpenDB(connector)
	defer func() {
	_ = db.Close()
	}()
	db.SetMaxOpenConns(1)
	db.SetMaxIdleConns(0)
	rows, err := db.Query(query)
	if err != nil {
	return nil, err
	}
	data, err := utils.UnmarshalSQLRows(rows)
	if err != nil {
	if data != nil && len(data.Rows) > 0 {
	return data, nil
	}
	return nil, err
	}
	return data, nil
	}
	func (c *OracleClient) ExecuteQueryWithDSN(ctx context.Context, dsn string, query string) (*utils.SQLResult, error) {
	executionId, err := executionIDFromContext(ctx)
	if err != nil {
	return nil, err
	}
	connector, err := c.oracleDbInstance(dsn, executionId)
	if err != nil {
	return nil, err
	}
	db := sql.OpenDB(connector)
	defer func() {
	_ = db.Close()
	}()
	db.SetMaxOpenConns(1)
	db.SetMaxIdleConns(0)
	rows, err := db.QueryContext(ctx, query)
	if err != nil {
	return nil, err
	}
	data, err := utils.UnmarshalSQLRows(rows)
	if err != nil {
	if data != nil && len(data.Rows) > 0 {
	return data, nil
	}
	return nil, err
	}
	return data, nil
	}

🤖 Prompt for AI Agents

In pkg/js/libs/oracle/oracle.go around lines 182 to 210, avoid panicking on a
missing executionId and run the query with context: first extract executionId
from ctx using a small helper that safely checks the type assertion (returning
an error if absent) instead of ctx.Value(...).(string); if oracleDbInstance can
accept context, pass ctx into it (or otherwise pass executionId after safe
extraction). Use db.QueryContext(ctx, query) instead of db.Query and defer
rows.Close() immediately after obtaining rows; ensure rows are closed on all
return paths and propagate ctx through any helper calls.

[Mzack9999]

re-creating due to GH automatic merge mess