fix(oracle): sanitize brackets in connection-URL userinfo before parse

[Bartok9]

Summary

• oracle:// connection URLs containing [ or ] in the userinfo (username/password) crashed with ValueError from urlparse's IPv6 netloc check.
• Bracketed credentials now parse, while legitimate bracketed IPv6 hosts still work.

Motivation

_make_oracle_connection called urlparse(url) directly. Python's urlparse treats [/] anywhere in the netloc as IPv6 host delimiters, so a URL like oracle://user:p[a]ss@host:1521/svc raises ValueError: 'host' does not appear to be an IPv4 or IPv6 address before any connection is attempted — the credential can never be used.

The MySQL connector already solved this exact problem with _parse_mysql_connection_url, which escapes brackets in the userinfo segment only. This change mirrors that helper for Oracle (_parse_oracle_connection_url), keeping valid IPv6 hosts (oracle://user:pass@[::1]:1521/svc) intact.

Verification

$ uv run pytest tests/unit/test_oracle_url_decode.py -q
4 passed in 0.20s

Regression test proof (fails without the fix):

$ git stash push -- src/wren/connector/oracle.py
$ uv run pytest tests/unit/test_oracle_url_decode.py -k "brackets or ipv6" -q
FAILED ...test_connection_url_with_brackets_in_credentials - ValueError: 'host' does not appear to be an IPv4 or IPv6 address
1 failed, 1 passed

The ipv6 test passes both with and without the fix, confirming no regression for legitimate bracketed IPv6 hosts.

Apache-2.0 path (core/**). One commit, two files.

Summary by CodeRabbit

• Bug Fixes
  • Improved Oracle connection URL handling so credentials containing [ or ] no longer break parsing.
  • Preserved correct handling of IPv6 host addresses while decoding connection details.
• Tests
  • Added coverage for bracketed credentials in the connection URL.
  • Added coverage to ensure IPv6 hosts remain unchanged during parsing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 411e0609-e29c-431b-8bb8-f626c25d2acb

📥 Commits

Reviewing files that changed from the base of the PR and between 7db2651 and 0718067.

📒 Files selected for processing (2)

• core/wren/src/wren/connector/oracle.py
• core/wren/tests/unit/test_oracle_url_decode.py

---

Walkthrough

Adds a helper _parse_oracle_connection_url in the Oracle connector that sanitizes [/] characters within the userinfo segment of a connection URL before parsing, updates _make_oracle_connection to use it, and adds two unit tests covering credential bracket sanitization and IPv6 host preservation.

Changes

Oracle URL parsing fix

Layer / File(s)	Summary
Sanitized URL parsing and connection wiring core/wren/src/wren/connector/oracle.py, core/wren/tests/unit/test_oracle_url_decode.py	Adds _parse_oracle_connection_url to sanitize [/] in the userinfo segment before calling urlparse, wires it into _make_oracle_connection for deriving username/password/hostname/path, and adds tests verifying bracketed credentials and IPv6 hosts parse correctly.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller as _make_oracle_connection
  participant Parser as _parse_oracle_connection_url
  participant Urlparse as urllib.parse.urlparse
  participant OracleDB as oracledb.connect

  Caller->>Parser: connection_url
  Parser->>Parser: sanitize [/] in userinfo segment
  Parser->>Urlparse: parse sanitized URL
  Urlparse-->>Parser: parsed result
  Parser-->>Caller: username, password, hostname, path
  Caller->>OracleDB: connect(user, password, host, service_name)

Loading

Suggested reviewers: goldmedal

Poem

A bunny hopped through URLs so tricky,
Brackets in passwords, oh so sticky!
I sanitized them with a gentle paw,
Now IPv6 hosts obey the law. 🐰
Hop, parse, connect — bug fixed, no flaw!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: sanitizing brackets in Oracle connection-URL userinfo before parsing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[goldmedal]

Thanks @Bartok9