SQL Injections - Oracle

•

0 gostou•380 visualizações

This document discusses SQL injections and how to avoid them in Oracle databases. It covers using explicitly bound arguments with dynamic SQL, validating and sanitizing input, and considering the use of invoker's rights instead of definer's rights. The goals are to explain what a SQL injection is with a basic example, how to avoid them, and the differences between invoker and definer rights.

Tecnologia

SQL Injections - Oracle
Ram Kedem
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Lesson Goals
• What is a SQL Injection – basic example
• Avoiding SQL Injections
• Using Invoker and Definer Rights
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

SQL Injection – Basic Example
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Avoiding SQL Injection
• To immunize your code against SQL injection attacks,
• Use bind arguments explicitly with dynamic SQL.
• Use bind arguments automatically with static SQL.
• Validate and sanitize all input concatenated to dynamic SQL (DBMS_ASSERT).
• Consider using Invoker’s rights.
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Explicitly bind arguments with dynamic SQL
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent

Explicitly bind arguments with dynamic SQL
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Automatic bind variables with static SQL
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Avoiding SQL Injection using
DBMS_ASSERT
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Invoker and Definer rights
• Definer’s rights:
• Programs execute with the privileges of the creating user.
• A user does not require privileges on underlying objects the procedure accesses.
• Only requires privilege to execute a procedure.
• Invoker’s rights:
• Programs execute with the privileges of the calling user.
• A user requires privileges on the underlying objects the procedure accesses.
• There is no need for duplication of code. A single compiled program unit can be
made to use schema A's objects when invoked by User A and schema B's objects
when invoked by User B.
• This way, we have the option of creating a code repository in one place and sharing it
with various production users.
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Definer’s rights
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Invoker’s rights
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Change Password Procedure
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Use Invoker's right
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Mais conteúdo relacionado

Destaque

Unite 8 carotte bâtonAmélie Baillargeon

Growth-mindset-business-model-youbirgittabiz

Lecture6LGS, GBHS&IC, University Of South-Asia, TARA-Technologies

Marknadskommunikation i ett förändrat medielandskapMellstrand

Agenda semana global de emprendimiento 2016FUSADES

Tarea del seminario 3marisa9773

B2B Inbound Summit: 5 steg till en Content Marketing-plan som fungerar i prak...Crescando

Unite 9 finaliteAmélie Baillargeon

Så hjälper du dina kunder att köpa med smart content marketingCrescando

Kona Biometric CardKona Software Lab Limited.

Lesson 5 securityRam Kedem

spring bed new heavensurabaya spring

Managing Knowledge and ChangePeter Bjellerup

TDC2016POA | Trilha BigData - Orquestrando Hadoop, Cassandra e MongoDB com o ...tdc-globalcode

Avvocati: le sanzioni e il procedimento disciplinareRenato Savoia

Digital Media Ingest and Storage Options on AWSAmazon Web Services

RWDG Webinar: Achieving Data Quality Through Data GovernanceDATAVERSITY

HadoopXML: A Suite for Parallel Processing of Massive XML Data with Multiple ...Kyong-Ha Lee

Destaque (18)

Unite 8 carotte bâton

Growth-mindset-business-model-you

Lecture6

Marknadskommunikation i ett förändrat medielandskap

Agenda semana global de emprendimiento 2016

Tarea del seminario 3

B2B Inbound Summit: 5 steg till en Content Marketing-plan som fungerar i prak...

Unite 9 finalite

Så hjälper du dina kunder att köpa med smart content marketing

Kona Biometric Card

Lesson 5 security

spring bed new heaven

Managing Knowledge and Change

TDC2016POA | Trilha BigData - Orquestrando Hadoop, Cassandra e MongoDB com o ...

Avvocati: le sanzioni e il procedimento disciplinare

Digital Media Ingest and Storage Options on AWS

RWDG Webinar: Achieving Data Quality Through Data Governance

HadoopXML: A Suite for Parallel Processing of Massive XML Data with Multiple ...

Semelhante a SQL Injections - Oracle

SSIS Data Flow Tasks Ram Kedem

Data Mining in SSASRam Kedem

Deploy SSRS Project - SQL Server 2014Ram Kedem

SSRS Basic ParametersRam Kedem

SQL Server: SecurityLearnNowOnline

Power Pivot and Power ViewRam Kedem

Working with Controllers and Actions in MVCLearnNowOnline

MSSQL Server - AutomationRam Kedem

Salesforce.com Training Course AgendaRMS Software Technologies

Open source Cloud Automation PlatformKishore Neelamegam

What's new in Silverlight 5LearnNowOnline

Redefining Perspectives edition 12 and 13 session 2sapientindia

Building share point apps with angularjsAhmed Elharouny

Community day _aws_ci_cd_v0.2VijayaNirmalaGopal

Application patternstomi vanek

SSRS Conditional FormattingRam Kedem

Couchbase usage at Symantecgauravchandna

Coordinating Micro-Services with Spring Cloud ContractOmri Spector

Enterprise Cloud with IBM & Chef (ChefConf 2013)Michael Elder

Deploying WebRTC successfully – A web developer perspectiveDialogic Inc.

Semelhante a SQL Injections - Oracle (20)

SSIS Data Flow Tasks

Data Mining in SSAS

Deploy SSRS Project - SQL Server 2014

SSRS Basic Parameters

SQL Server: Security

Power Pivot and Power View

Working with Controllers and Actions in MVC

MSSQL Server - Automation

Salesforce.com Training Course Agenda

Open source Cloud Automation Platform

What's new in Silverlight 5

Redefining Perspectives edition 12 and 13 session 2

Building share point apps with angularjs

Community day _aws_ci_cd_v0.2

Application patterns

SSRS Conditional Formatting

Couchbase usage at Symantec

Coordinating Micro-Services with Spring Cloud Contract

Enterprise Cloud with IBM & Chef (ChefConf 2013)

Deploying WebRTC successfully – A web developer perspective

Mais de Ram Kedem

Impala use case @ edgeRam Kedem

Advanced SQL WebinarRam Kedem

Managing oracle Database InstanceRam Kedem

DDL Practice (Hebrew)Ram Kedem

DML Practice (Hebrew)Ram Kedem

Exploring Oracle Database Architecture (Hebrew)Ram Kedem

Introduction to SQLRam Kedem

Introduction to DatabasesRam Kedem

Pig - Processing XML dataRam Kedem

SSRS GaugesRam Kedem

SSRS Calculated FieldsRam Kedem

SSRS GroupsRam Kedem

Data Warehouse Design ConsiderationsRam Kedem

Data Warehouse BasicsRam Kedem

Mais de Ram Kedem (14)

Impala use case @ edge

Advanced SQL Webinar

Managing oracle Database Instance

DDL Practice (Hebrew)

DML Practice (Hebrew)

Exploring Oracle Database Architecture (Hebrew)

Introduction to SQL

Introduction to Databases

Pig - Processing XML data

SSRS Gauges

SSRS Calculated Fields

SSRS Groups

Data Warehouse Design Considerations

Data Warehouse Basics

Último

Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC

A Domino Admins Adventures (Engage 2024)Gabriella Davis

#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada

[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745

Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik

FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh

08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls

A Call to Action for Generative AI in 2024Results

My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar

Maximizing Board Effectiveness 2024 Webinar.pptxOnBoard

IAC 2024 - IA Fast Track to Search Focused AI SolutionsEnterprise Knowledge

Understanding the Laravel MVC ArchitecturePixlogix Infotech

Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55

Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK

Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...gurkirankumar98700

Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun

🐬 The future of MySQL is Postgres 🐘RTylerCroy

Salesforce Community Group Quito, Salesforce 101Paola De la Torre

Finology Group – Insurtech Innovation Award 2024The Digital Insurer

Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko

SQL Injections - Oracle

2. Lesson Goals • What is a SQL Injection – basic example • Avoiding SQL Injections • Using Invoker and Definer Rights Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent Ramkedem.com

5. Avoiding SQL Injection • To immunize your code against SQL injection attacks, • Use bind arguments explicitly with dynamic SQL. • Use bind arguments automatically with static SQL. • Validate and sanitize all input concatenated to dynamic SQL (DBMS_ASSERT). • Consider using Invoker’s rights. Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent Ramkedem.com

15. Invoker and Definer rights • Definer’s rights: • Programs execute with the privileges of the creating user. • A user does not require privileges on underlying objects the procedure accesses. • Only requires privilege to execute a procedure. • Invoker’s rights: • Programs execute with the privileges of the calling user. • A user requires privileges on the underlying objects the procedure accesses. • There is no need for duplication of code. A single compiled program unit can be made to use schema A's objects when invoked by User A and schema B's objects when invoked by User B. • This way, we have the option of creating a code repository in one place and sharing it with various production users. Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent Ramkedem.com

SQL Injections - Oracle

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (18)

Semelhante a SQL Injections - Oracle

Semelhante a SQL Injections - Oracle (20)

Mais de Ram Kedem

Mais de Ram Kedem (14)

Último

Último (20)

SQL Injections - Oracle