fix(js): normalize & reject trace file DSN opts in oracle

[dwisiswant0]

Proposed changes

go-ora accepts TRACE {FILE,DIR}-style DSN options
and may create those files while opening the conn.
Normalize those paths and reject outside paths
unless -allow-local-file-access is enabled.

Proof

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• Bug Fixes

  • Improved Oracle connection string handling by validating DSN trace options during initialization.
  • Normalize Oracle trace file/directory paths within allowed templates to ensure consistent behavior.
  • Reject Oracle DSN trace paths when local file access is not permitted.

• Tests

  • Added coverage for Oracle DSN sandboxing and trace option validation, including cases with and without local file access enabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 228237a1-09f4-4ac8-b389-3fdc115b0576

📥 Commits

Reviewing files that changed from the base of the PR and between 0ccbe21 and dbcf985.

📒 Files selected for processing (2)

• pkg/js/libs/oracle/oracle.go
• pkg/js/libs/oracle/oracle_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/js/libs/oracle/oracle_test.go
• pkg/js/libs/oracle/oracle.go

---

Walkthrough

Oracle DSN handling gains a sandboxDSN helper that parses DSN query parameters, detects trace-related options (TRACE FILE, TRACE DIR, etc.), and normalizes their path values via protocolstate.NormalizePathWithExecutionId. oracleDbInstance calls it before opening a connection and fails early on error. Four tests cover rejection, normalization, and LFA-enabled pass-through scenarios.

Changes

Oracle DSN trace-path sandboxing

Layer / File(s)	Summary
sandboxDSN implementation and oracleDbInstance integration pkg/js/libs/oracle/oracle.go	Adds net/url and strings imports; wires sandboxDSN call into oracleDbInstance for early failure; implements sandboxDSN (DSN URL parsing, trace-param iteration, NormalizePathWithExecutionId calls, re-encoding) and isOracleTracePathOption (uppercased key matching).
DSN sandbox tests pkg/js/libs/oracle/oracle_test.go	Adds four tests: LFA-disabled rejection of out-of-templates TRACE FILE, ConnectWithDSN early rejection before Oracle open, normalization of in-templates trace paths, and LFA-enabled pass-through; adds restoreOracleTemplatesDir test helper.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hop, hop — no sneaky trace files today!
The DSN gets scrubbed before it can stray,
Paths outside templates are turned right away,
Unless LFA waves its flag to say "okay."
The bunny keeps tunnels both tidy and safe! 🐾

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly and concisely summarizes the main change: normalizing and rejecting trace file DSN options in Oracle connections for security purposes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dwisiswant0/fix/js/normalize-reject-trace-file-DSN-opts-in-oracle

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dwisiswant0]

@coderabbitai create an issue for this, prefixed with [BUG].

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

gh issue create \
  --repo "projectdiscovery/nuclei" \
  --assignee "dwisiswant0" \
  --title "[BUG] Oracle DSN TRACE options may create arbitrary files on the system" \
  --body "## Description

The \`go-ora\` library used in the nuclei Oracle JS module accepts \`TRACE FILE\` and \`TRACE DIR\` style DSN (Data Source Name) options. When a database connection is opened using such a DSN, the library may create trace files at the paths specified in those options — including arbitrary locations on the filesystem.

This allows unintended or malicious file creation outside of allowed directories simply by crafting a DSN with trace path options, unless the \`-allow-local-file-access\` (\`-lfa\`) flag is explicitly enabled.

## Affected Component

- \`pkg/js/libs/oracle/oracle.go\` — \`OracleClient.ConnectWithDSN\`

## Expected Behavior

Oracle DSN trace path options should be normalized and rejected (with an appropriate error) if they point to paths outside the allowed templates directory, unless \`-allow-local-file-access\` is explicitly enabled.

## Actual Behavior

No validation is performed on trace path DSN options before passing the DSN to \`go-ora\`, allowing arbitrary file creation on the host system.

## Fix

Normalize DSN trace paths via \`protocolstate.NormalizePathWithExecutionId\` and reject any path falling outside the allowed location unless \`-lfa\` is enabled.

## References

- Fix in progress: https://github.com/projectdiscovery/nuclei/pull/7480
- Reported by: `@dwisiswant0`"

Length of output: 1640

---

---

@dwisiswant0: Done! The issue has been created and assigned to you: #7485