Security procedures/packages. Hide source code?

Hello.

I was wondering if it is possible to hide the source code of a procedure for a user or to avoid him to recreate it, but leave it to run it.

Im doing a procedure of Lac sand which modify and run an external task. It works fine, but I see a lot of security holes. If any DB user who can execute this procedure can change too, they could run any command shell by modifying the attributes of external work. I could use the credentials (11.2.0.2) and somehow limit the use of the system to specific orders, but I want to fix the security hole by limiting the user DB limiting rather the user of the system.

It is the external work
BEGIN
DBMS_SCHEDULER.CREATE_JOB(
job_name => 'test',
job_type => 'EXECUTABLE',
job_action => '/bin/sh',
number_of_arguments => 2
);

DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE (
job_name => 'test',
argument_position => 1,
argument_value => '-c'
);

DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE (
job_name => 'test',
argument_position => 2,
argument_value => '/bin/date>>/tmp/date.log'
);
END;
/ 
And then the procedure.
CREATE OR REPLACE PROCEDURE TEST_DATE_FILE ( new_file IN varchar2 )
IS BEGIN
DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE (
job_name => 'test',
argument_position => 2,
argument_value => '/bin/date>>/tmp/' || new_file
);

DBMS_SCHEDULER.RUN_JOB(
                                job_name =>             'test',
                                use_current_session =>  TRUE
                                );
END;
/
--
SQL > conn scott/tiger
Conectado.
SQL > exec TEST_DATE_FILE('newfile.log');

Procedure-PL/SQL terminado correctamente.

SQL > CREATE OR REPLACE PROCEDURE SYS. TEST_DATE_FILE (new_file IN varchar2)
2. IS BEGIN
3 DBMS_SCHEDULER. () SET_JOB_ARGUMENT_VALUE
job_name 4 = > 'test ',.
5 argument_position = > 2,
argument_value 6 = > "rm - rf/bin / / tmp / *'"
(7);
8
9 DBMS_SCHEDULER. () RUN_JOB
job_name 10 = > 'test ',.
11 use_current_session = > TRUE
(12);
13 END;
14.

Created procedure.

SQL > exec TEST_DATE_FILE (' ');

Procedure-PL/SQL terminado correctamente.

--

It is possible to hide the source code of the procedure that edits and run the external procedure?
There is no work around or any idea how I can avoid this?

Concerning

Published by: elvegaa_esp on 17-may-2012 02:41

Published by: elvegaa_esp on 17-may-2012 02:43

[email protected] > host wrap iname = test.sql oname = test_wrap.sql

PL/SQL Wrapper: Release 8.1.7.2.0 - Production on Mon Jan 07 12:44:21 2002
Copyright (c) 1993 Oracle Corporation, 2000. All rights reserved.
Test.sql to test_wrap.sql treatment

[email protected] > @test_wrap.sql
[email protected] > create or replace procedure wrapped p
2 0
3 abcd
4 abcd
5-abcd
6 abcd
7 abcd
8 abcd
9 abcd
10 abcd
11-abcd
12 abcd
13 abcd
14 abcd
ABCD 15
ABCD 16
17 abcd
18 3
19 7
20 8106000
21 1
22 4
23 0
24 4
25 2: e:
26 1 P:
27 1DBMS_OUTPUT:
28 1PUT_LINE:
29 1Hello world:
30 0
31
...
86.

Created procedure.

and now you do not have

[email protected] > select text from user_source where name = 'P ';

TEXT
----------------------------------------------------------------------------------------------------
-------------------------------
procedure wrapped p
0
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
ABCD
3
7
8106000
1
4
0
4
2: e:
1 P:
1DBMS_OUTPUT:
1PUT_LINE:
1Hello world:
0
...

[email protected] >

Published by: human Chen on May 29, 2012 11:26

Tags: Database

Similar Questions

  • Security problem for the source code

    Hello guys '

    I have a question about the safety of coding. So, I know that anyone can create .jar .java or .class file.

    And my question:

    Is it possible to create the .cod file .java file? I think the best solution to save the source code uses secure obfuscator.

    Do you use the Java obfuscator? What obfuscator is the best?

    Please share your knowledge with me ' guy

    TNX'

    You would like to read the following Article:

    How to-obfuscate code in a BlackBerry application
    Article number: DB-00438

    http://www.BlackBerry.com/knowledgecenterpublic/livelink.exe/fetch/2000/348583/800901/How_To_-_Obfus...

    I know that a BlackBerry development company using Proguard.

  • String panipulation - rename the package name in the source code.

    I want to do the replacement string as below:
    select 'CREATE OR REPLACE PACKAGE CollectStats IS
      PROCEDURE save_log(p_logrec IN LiveStatsLog%ROWTYPE);
      PROCEDURE UpdateLiveGamesHourlyStats;
      PROCEDURE UpdateSideGamesHourlyStats;
      PROCEDURE UpdateConcurrentPlayerStats;
      PROCEDURE CollectStats;
    END CollectStats;' from dual;
    
    -->
    
    select 'CREATE OR REPLACE PACKAGE CollectStats_20100810 IS
      PROCEDURE save_log(p_logrec IN LiveStatsLog%ROWTYPE);
      PROCEDURE UpdateLiveGamesHourlyStats;
      PROCEDURE UpdateSideGamesHourlyStats;
      PROCEDURE UpdateConcurrentPlayerStats;
      PROCEDURE CollectStats;
    END CollectStats_20100810;' from dual;
    The point is to rename the name of the package in the Package source code, in the first and the last line of the source code.
    This is only an example package. The query must sort the replacement of the chain so that the result would be, as shown in a package with a different name.
    Note that name of the package, and a procedure within the source code of the package are the same - see "PROCÉDURE CollectStats;".

    Somehow the replacement of the regular expression should be used.

    Published by: CharlesRoos on August 11, 2010 03:31

    Try this:

    SQL> ed
    Wrote file afiedt.buf
    
      1  with t as (select 'CREATE OR REPLACE PACKAGE BODY "XXX"."COLLECTSTATS" IS....
      2  PROCEDURE CollectStats IS
      3    BEGIN
      4      UpdateLiveGamesHourlyStats;
      5     UpdateSideGamesHourlyStats;
      6      UpdateConcurrentPlayerStats;
      7    END CollectStats;
      8  END CollectStats;
      9  /' body from dual)
     10  SELECT REPLACE(REPLACE(body,'BODY "XXX"."COLLECTSTATS"','BODY "XXX"."COLLECTSTATS_20100811"'),
     11         'END CollectStats;'||CHR(10)||'/','END CollectStats_20100811;'||CHR(10)||'/') body
     12* from t
    SQL> /
    
    BODY
    ----------------------------------------------------------------------------------------------------
    CREATE OR REPLACE PACKAGE BODY "XXX"."COLLECTSTATS_20100811" IS....
    PROCEDURE CollectStats IS
      BEGIN
        UpdateLiveGamesHourlyStats;
            UpdateSideGamesHourlyStats;
        UpdateConcurrentPlayerStats;
      END CollectStats;
    END CollectStats_20100811;
    /
    
    SQL> 
    
  • Get the source code of a procedure for a huge package in oracle

    I have a package which, as methods of 40-50 in them, I would like to retrieve the source of one inside the package. is there a table where I can get this detail in the oracle database.


    I know there is an all_source table, which has the entire source code, but I want to only get the source code for a particular procedure.

    Thanks in advance.

    You have defined your procedure as provided

    procedure procedure_name...
    ...
    end procedure_name;
    

    and the procedure is not overloaded, you can try something as

    with
    first_line as
    (select line
       from all_source
      where instr(lower(text),'procedure '||lower(:procedure_name)) > 0
        and name = :package_name
        and type = 'PACKAGE BODY'
        and owner = :package_owner
    ),
    last_line as
    (select line
       from all_source
      where instr(lower(text),'end '||lower(:procedure_name)||';') > 0
        and name = :package_name
        and type = 'PACKAGE BODY'
        and owner = :package_owner
    ),
    select text
      from all_source
     where line between (select line from first_line)
                    and (select line from last_line)
     order by line
    

    Concerning

    Etbin

  • packaging and unwrapping source code

    Hi all

    I'm having a problem of security. I want to do something about packaging for objects of database such as procedures, packages and features.
    can someone tell me how I can wrap my source codes. And also how do I place these codes wrapped whenever I need... ???


    can someone help me solve this problem please.


    Thanks in advance,
    Max

    Dear Max,

    If you have encapsulated code, you can use this url: http://hz.codecheck.ch/UnwrapIt/Unwrap.jsp

    and no packaged code.

    If you want to encapsulate your code, just read:

    c:\ora9i\bin > wrap iname = input_file_name

    The Wrap utility

    To run the utility of Wrap, enter the command wrap at the operating system command prompt using the following syntax:

    Wrap iname = input_file [output_file = oname]

    Because spaces delimit individual arguments leave no space around the equal sign.

    The command of the envelope only requires a single argument, which is

    INAME = input_file

    Where input_file is the name of the input file Wrap Utility. You should not specify the file extension because its default SQL. For example, the following commands are equivalent:

    Wrap iname = / mydir/myfile
    wrap iname=/mydir/myfile.sql

    However, you can specify a different file extension as shown in the following example:

    wrap iname=/mydir/myfile.src

  • Required privilege to view the source code for the stored procedure

    RDBMS Version: 11.2.0.4

    Platform: Oracle Linux 6.4

    In our Production database, we have an application schema named CRM_PROD. And we have a read-only user named steve in this PB.

    Steve must be able to view the source code of all stored procedures, functions and packages in the CRM_PROD schema. But steve shouldn't be able to run these procedures, functions and packages in the CRM_PROD schema. What a privilege should give Steve for this?

    SYS is owner of the dictionary of data and tables for the source code. See configuration of privilege and role authorization - 11 g Release 2 (11.2).

    Select it no matter what dictionary grant will give user (read) access to the full data dictionary.

  • Can you have multiple packages in a source code file, or you have several files?

    Can you have multiple packages in a source code file, or you have several files?

    ExampleClass must be saved in a directory as well as your main fla.

    This directory must have a subdirectory named samples containing SampleCode.

  • How to find the source code (package / service..) a concurrent program

    Hello


    I gives me the name of a concurrent program.

    Now my question is, how do I find the source code for the simultaneous progra.


    Could someone explain to me.

    FYI: I have full access (sysadmin).

    Thank you
    Prasad
    Senior Oracle Apps DBA

    PL post Details of the operating system, database and versions EBS.

    Responsibility of the system administrator, go to the competitor > program > set and search for the name of your simultaneous program. When you find it, there will be a 'the executable name' that are associated with him.

    Go to the competitor > program > executable and locate the 'name of the executable"- and you will get the information you need.

    http://docs.Oracle.com/CD/E18727_01/doc.121/e12897/T302934T458253.htm

    HTH
    Srini

  • Source code is the same name but different schema owner

    I got 1 of the online test and there the question has been asked. I have already answered but curious to cross-check my response with your advice...

    Question

    You want to see the source code of your defined package 'test1' and you issue the following query:

    Select the text in all_source

    WHERE name = "test1";

    After executing query, you have noticed that the result has 1 or more of source code with the code source test1 with the same name, but exist in different schema owner.

    Based on above circumstances, which is the type of possible object of the other source code?

    a Package

    b form

    c View

    d table

    e synonym

    My response was a (Package).

    Concerning

    Muzz

    Hello

    You answer is correct, all_source contains code for one of the following object types

    FUNCTION, JAVA SOURCE, PACKAGE, PACKAGE BODY, PROCEDURE, TRIGGER, TYPE,TYPE BODY

    for more detail check the following link

    http://docs.oracle.com/cloud/latest/db121/REFRN/refrn20249.htm#REFRN20249

    Concerning

    Salim

  • Enter the source code before and after recompilation/crush

    Hello

    I am trying to store the source code of a program unit in a table before and after the source code "changed". I tried to do it with a BEFORE and AFTER the level scheme of UPDATE trigger, respectively, what fire for a CREATE event - both use the DBMS_METADATA. Routine GET_DDL to generate the code. The problem is that the source code that is returned by dbms_metadata.get_ddl in both triggers will return the code prior to the change, rather than after the change. Can anyone suggest how I could manage to capture the most recent/changed version of source code.

    Kind regards

    Kevin.

    CREATE OR REPLACE

    CODE_BEFORE RELAXATION

    BEFORE YOU CREATE

    WE DATABASE

    DECLARE

    CURSOR v_cur

    IS

    SELECT TEXT

    OF DBA_SOURCE

    WHERE OWNER = ora_dict_obj_owner

    AND NAME = ora_dict_obj_name

    AND TYPE = ora_dict_obj_type

    ONLINE ORDERING;

    BEGIN

    IF ora_dict_obj_type () IN

    'PROCEDURE ',.

    "FUNCTION."

    'PACKAGE ',.

    'PACKAGE BODY '.

    )

    THEN

    dbms_output.put_line ('= CODE BEFORE =');

    FOR v_rec IN v_cur LOOP

    dbms_output.put_line (v_rec. (Text);

    END LOOP;

    END IF;

    END;

    /

    CREATE OR REPLACE

    CODE_AFTER RELAXATION

    AFTER CREATE

    WE DATABASE

    DECLARE

    v_sql_text ora_name_list_t;

    V_I int;

    v_stmt CLOB.

    BEGIN

    IF ora_dict_obj_type () IN

    'PROCEDURE ',.

    "FUNCTION."

    'PACKAGE ',.

    'PACKAGE BODY '.

    )

    THEN

    V_I: = ora_sql_txt (v_sql_text);

    dbms_output.put_line ('= CODE AFTER =');

    I'm IN 1.v_i LOOP

    dbms_output.put_line (v_sql_text (i));

    v_stmt: = v_stmt | v_sql_text (i);

    END LOOP;

    END IF;

    END;

    /

    Now:

    SQL > set serveroutput on
    SQL > create or replace
    2 procedure p1
    3 is
    4 start
    5 dbms_output.put_line('original');
    6 end;
    7.
    = THE CODE FRONT =.
    = CODE AFTER =.
    create or replace
    procedure p1
    is
    Start
    dbms_o
    UTPUT.put_line ('original');
    end;

    Created procedure.

    SQL > create or replace
    2 procedure p1
    3 is
    4 start
    5 dbms_output.put_line('modified');
    6 end;
    7.
    = THE CODE FRONT =.
    procedure p1

    is

    Start

    dbms_output.put_line ('original');

    end;
    = CODE AFTER =.
    create or replace
    procedure p1
    is
    Start
    dbms_o
    UTPUT.put_line ('modified');
    end;

    Created procedure.

    SQL >

    SY.

  • Anonymous block Source code

    How can I request/access to the source code of an anonymous block? For example, if I want the source of a particular procedure, it is accessible from the table 'all_source. Even if she throws the source for an anonymous block after it is done with her, always store it somewhere while it's executing analysis, it should at least be accessible as part of the package as follows:
    declare
        src_code varchar2;
    begin
        select source
        into   src_code
        from   wherever the DB stores it;
    
        dbms_output.put_line(src_code);
    end;

    How can I request/access to the source code of an anonymous block

    If you give the anonymous block a unique label, you might be able to query v$ sql:

    SQL> col guid new_val guid
    SQL>
    SQL> select sys_guid() guid from dual
      2  /
    
    GUID
    --------------------------------
    C418F340066DF07FE04017AC25922063
    
    SQL>
    SQL> declare
      2    sql_text   long;
      3    label      long := '&&guid';
      4  begin
      5    select sql_fulltext
      6      into sql_text
      7      from v$sql
      8     where sql_fulltext like '%' || label || '%';
      9
     10    dbms_output.put_line ('SQL of anonymous block:');
     11    dbms_output.put_line (sql_text);
     12  end;
     13  /
    old   3:   label      long := '&&guid';
    new   3:   label      long := 'C418F340066DF07FE04017AC25922063';
    SQL of anonymous block:
    declare
      sql_text   long;
      label      long := 'C418F340066DF07FE04017AC25922063';
    begin
      select sql_fulltext
        into sql_text
        from v$sql
    
    where sql_fulltext like '%' || label || '%';
    
      dbms_output.put_line ('SQL of anonymous block:');
      dbms_output.put_line (sql_text);
    end;
    
    PL/SQL procedure successfully completed.
    
    SQL>
    
  • Security Oracle - Unwrapping PL/SQL code - bug share your point of view

    Hi all

    This is a very abnormal case to unwrap PL/SQL wrapped codes. Is this a bug in Oracle security, or... And how it is possible to unpack the code that is wrapped by the #1 database system and which ensured that "the encapsulated code is not possible to be désencapsulé.

    Please send us your review

    - - - - - - - - - - - - - - - - - - - - -
    Kamran Agayev a. (OCP 9i / 10g)
    Author of the forthcoming book--"Oracle Backup & Recovery: Expert secrets to use RMAN and Data Pump.
    http://www.rampant-books.com/book_1002_rman_backup_recovery.htm

    Hi guys,.

    Some interesting points in this thread. First wrap Oracle deal is pre - 10g and 10g post (both methods are very different) is not encryption, its simple obfuscation (your opinion on the definition of 'simple' may vary). Oracle do not specify in their documentation, that it is a secure solution, they say its obfuscation. There are unwrappers there for two types of film. A comment on the thread suggests that only the structure of the code is possible to get by using an unwrapper. Is not true, and the misconception is perhaps because some of the unwrappers there have been created for security researchers/consultants so that they could find bugs and in these cases the recovery of the real source code was not necessary.

    Is this a bug there is a possibility to reveal? in theory, probably 'no' because Oracle never told code recovery was impossible. Can they do the packing process harder? -probably, it is worth? not sure, which is being implemented would probably be broken. A better solution might be a customer solution based, that is, Oracle provides the mechanism of the envelope and we as customers provide our own key? It is defective although, as the needs of database to decipher (UN-hide) the code so it can be loaded. The pcode would be always available and should not "too long" for someone to go straight from pcode back to PL/SQL.

    see you soon

    Pete

  • Real-time application does not work; source code works very well

    The short version is I'm programming a cRIO and apparently the RT code isn't running after you deploy, and I can't understand why. It is further complicated as I do all this remote and I don't have direct access to the unit since I am 500 miles away. I work through a couple of other guys who know some LabVIEW, but neither is working on the site so that they explicitly trip there whenever I have a bright idea.

    I was there a few weeks ago. During this time, I created a code simple cRIO, since I'm new to the cRIO, allowing the user to move a control and change a chart. It worked fine, but I must stress that it did not have a FPGA component. After that, I worked on the actual code, which reads some sensors, displays the results on a user interface and stores the results. Did FPGA. I used it in the LabVIEW environment and it worked fine, but I ran out of time before I could finish a release build and deploy the RT as a compiled application. I sent them the version later, my contact deployed but had the network stream errors during execution of the user interface.

    After hours to address network problems and sending over debug versions, I tried to create a log on RT level so I could see what was going on. The journal is not yet open, even if it is the first command in the code. I have pores through the forums and found http://forums.ni.com/t5/LabVIEW/cRIO-Troubleshooting-creation-and-deployment-of-startup/td-p/1956475... which took a new direction.

    I had my contact use the RT debug console and when it pulls up to the front of the RT, it shows an arrow broken at delivery. He clicked and nothing happens - no work, no list of bugs. If he shoots to the top of the list of bugs manually, it is empty. Again, the RT works very well if you run it through LabVIEW and not as an application compiled in real-time. He also noticed that the open FPGA VI was grey on the block diagram. Are no other icons.

    If the problem seems to be that the compiled application of RT becomes some kind of error, but do not tell me what it is, and it seems to be related to the opening of the FPGA. I recompiled the FPGA and RT. I recompile the RT himself, but not the FPGA, because this would take hours. It is download everything properly for the cRIO. The RT is set to run automatically. It is restarted the cRIO whenever he deploys the RT. They have LabVIEW on a computer, but it doesn't have the correct drivers to run the code of the environment of LV. I am to resist have them install the dirvers because downloading big files is complicated due to the restrictions of security as well as a lousy connection at a remote site. In addition, it does not solve the problem of RT executable doesn't work is not the same as the source code, which, according to the thread above, seems to be a thing.

    The last thing I'm getting is that I sent her instructions for how to build a source distribution of the project that I sent and try to deploy on the cRIO. Even if it works, I'm not sure that this is an acceptable solution, because I assume running VI, rather than the EXE is slower, and they need to speed on this project.

    Simply, I don't know where to go from here. I probably need to get direct access to the cRIO and I might be able to convince them to ship to me so I can understand this point, but I don't know where I got same departure other than the Voodoo debugging standard of "trying stuff randomly until something works". I am open to suggestions, if someone managed to solve this before.

    Code snippet of the first part of the project is fixed, although I don't know how much what good it will do. I am really confused, and the customer is frustrated with how much budget is going to solve this problem.


  • Source code for ice cream sandwich

    Android is the operating system open source. But sony did not source after that they change it. Why sony doesn't have the source code of the ROM after each update of mobile phones? I think that people who know this programming could help solve bugs and find the error more quickly than a few developers of sony. This way users will be happier because bugs will be resolved quickly and we could better use our device we could we parameterization software. This way users will be happier because bugs will be resolved quickly and we could better use our device we could we parameterization software. I also think that sony would benefit from this since it would have more sales.

    I would be very happy if you give me an answer very enlightening and logic to explain why really the sony insists on hide the source even if sony has get the source code from google with permissions of open source.

    Visit this link to all your queries will be answered

    http://developer.sonymobile.com/downloads/opensource/

    Please check correct/useful if you find my post helpful!

    too many programmers get the file manual.ftp and help the customizations add and remove bugs with ics! just you need to unlock the bootloader for it!

  • Android source code?

    I'm trying to get a better understanding of the esp. DMS about how myApp.apk be synch'ed down to the Android device.

    Please, how to find the Android source code for:

    Installing Oracle

    Oracle DMAgent

    (and especially)

    The Oracle Update

    ?

    -JD

    The side of the App is done with the package Wizard.

    Mike

Maybe you are looking for

  • Possible on a Satellite L300D AHCI?

    Hello I just installed an SSD in my mother age L300D - 12L, hoping to give him a nice performance boost.It installed and cloned from the original fine, disc but I was surprised to see that it takes now about 5 seconds more to start with the old mecha

  • HP Scan for MacOS 10.9 Mavericks update

    When HP will provide an update for HP Scan to allow him to work with the Mavericks 10.9 MacOS?

  • WINDOWS EXPLORER COMPATIBILITY FILES

    WINDOWS VISTA: I downloaded files in a new folder in windows Explorer.   Later when I went to look at the files, they weren't there, I had to click on a button that says "compatibility files" then I could see them. Is it possible that the default vie

  • XPS L502X w / Intel chip support 6230 Bluetooth * 2.1, 2.1 + EDR, 3.0, 3.0 + HS: any stereo Bluetooth headset, headphones, etc.

    I want something to make me pass stereo audio using the Bluetooth radio already in my laptop. I bought a pair of headsets Plantronics BackBeat go.   They could combine with the laptop, but then in the next step, Windows (7 Home Premium) Impossible to

  • Policy playBook

    I create an HTML5 WebWorks for PlayBook application and I fight problems with orientation changes. I see now why so many applications PlayBook, such as Facebook, simply lock direction or another. I know that to get a good solution to this problem I m