SQL Injections - Oracle

•

0 gefällt mir•380 views

This document discusses SQL injections and how to avoid them in Oracle databases. It covers using explicitly bound arguments with dynamic SQL, validating and sanitizing input, and considering the use of invoker's rights instead of definer's rights. The goals are to explain what a SQL injection is with a basic example, how to avoid them, and the differences between invoker and definer rights.

Technologie

SQL Injections - Oracle
Ram Kedem
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Lesson Goals
• What is a SQL Injection – basic example
• Avoiding SQL Injections
• Using Invoker and Definer Rights
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

SQL Injection – Basic Example
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Avoiding SQL Injection
• To immunize your code against SQL injection attacks,
• Use bind arguments explicitly with dynamic SQL.
• Use bind arguments automatically with static SQL.
• Validate and sanitize all input concatenated to dynamic SQL (DBMS_ASSERT).
• Consider using Invoker’s rights.
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Explicitly bind arguments with dynamic SQL
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent

Explicitly bind arguments with dynamic SQL
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Automatic bind variables with static SQL
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Avoiding SQL Injection using
DBMS_ASSERT
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Invoker and Definer rights
• Definer’s rights:
• Programs execute with the privileges of the creating user.
• A user does not require privileges on underlying objects the procedure accesses.
• Only requires privilege to execute a procedure.
• Invoker’s rights:
• Programs execute with the privileges of the calling user.
• A user requires privileges on the underlying objects the procedure accesses.
• There is no need for duplication of code. A single compiled program unit can be
made to use schema A's objects when invoked by User A and schema B's objects
when invoked by User B.
• This way, we have the option of creating a code repository in one place and sharing it
with various production users.
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Definer’s rights
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Invoker’s rights
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Change Password Procedure
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Use Invoker's right
Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent
Ramkedem.com

Weitere ähnliche Inhalte

Andere mochten auch

Unite 8 carotte bâtonAmélie Baillargeon

Growth-mindset-business-model-youbirgittabiz

Lecture6LGS, GBHS&IC, University Of South-Asia, TARA-Technologies

Marknadskommunikation i ett förändrat medielandskapMellstrand

Agenda semana global de emprendimiento 2016FUSADES

Tarea del seminario 3marisa9773

B2B Inbound Summit: 5 steg till en Content Marketing-plan som fungerar i prak...Crescando

Unite 9 finaliteAmélie Baillargeon

Så hjälper du dina kunder att köpa med smart content marketingCrescando

Kona Biometric CardKona Software Lab Limited.

Lesson 5 securityRam Kedem

spring bed new heavensurabaya spring

Managing Knowledge and ChangePeter Bjellerup

TDC2016POA | Trilha BigData - Orquestrando Hadoop, Cassandra e MongoDB com o ...tdc-globalcode

Avvocati: le sanzioni e il procedimento disciplinareRenato Savoia

Digital Media Ingest and Storage Options on AWSAmazon Web Services

RWDG Webinar: Achieving Data Quality Through Data GovernanceDATAVERSITY

HadoopXML: A Suite for Parallel Processing of Massive XML Data with Multiple ...Kyong-Ha Lee

Andere mochten auch (18)

Unite 8 carotte bâton

Growth-mindset-business-model-you

Lecture6

Marknadskommunikation i ett förändrat medielandskap

Agenda semana global de emprendimiento 2016

Tarea del seminario 3

B2B Inbound Summit: 5 steg till en Content Marketing-plan som fungerar i prak...

Unite 9 finalite

Så hjälper du dina kunder att köpa med smart content marketing

Kona Biometric Card

Lesson 5 security

spring bed new heaven

Managing Knowledge and Change

TDC2016POA | Trilha BigData - Orquestrando Hadoop, Cassandra e MongoDB com o ...

Avvocati: le sanzioni e il procedimento disciplinare

Digital Media Ingest and Storage Options on AWS

RWDG Webinar: Achieving Data Quality Through Data Governance

HadoopXML: A Suite for Parallel Processing of Massive XML Data with Multiple ...

Ähnlich wie SQL Injections - Oracle

SSIS Data Flow Tasks Ram Kedem

Data Mining in SSASRam Kedem

Deploy SSRS Project - SQL Server 2014Ram Kedem

SSRS Basic ParametersRam Kedem

SQL Server: SecurityLearnNowOnline

Power Pivot and Power ViewRam Kedem

Working with Controllers and Actions in MVCLearnNowOnline

MSSQL Server - AutomationRam Kedem

Salesforce.com Training Course AgendaRMS Software Technologies

Open source Cloud Automation PlatformKishore Neelamegam

What's new in Silverlight 5LearnNowOnline

Redefining Perspectives edition 12 and 13 session 2sapientindia

Building share point apps with angularjsAhmed Elharouny

Community day _aws_ci_cd_v0.2VijayaNirmalaGopal

Application patternstomi vanek

SSRS Conditional FormattingRam Kedem

Couchbase usage at Symantecgauravchandna

Coordinating Micro-Services with Spring Cloud ContractOmri Spector

Enterprise Cloud with IBM & Chef (ChefConf 2013)Michael Elder

Deploying WebRTC successfully – A web developer perspectiveDialogic Inc.

Ähnlich wie SQL Injections - Oracle (20)

SSIS Data Flow Tasks

Data Mining in SSAS

Deploy SSRS Project - SQL Server 2014

SSRS Basic Parameters

SQL Server: Security

Power Pivot and Power View

Working with Controllers and Actions in MVC

MSSQL Server - Automation

Salesforce.com Training Course Agenda

Open source Cloud Automation Platform

What's new in Silverlight 5

Redefining Perspectives edition 12 and 13 session 2

Building share point apps with angularjs

Community day _aws_ci_cd_v0.2

Application patterns

SSRS Conditional Formatting

Couchbase usage at Symantec

Coordinating Micro-Services with Spring Cloud Contract

Enterprise Cloud with IBM & Chef (ChefConf 2013)

Deploying WebRTC successfully – A web developer perspective

Mehr von Ram Kedem

Impala use case @ edgeRam Kedem

Advanced SQL WebinarRam Kedem

Managing oracle Database InstanceRam Kedem

DDL Practice (Hebrew)Ram Kedem

DML Practice (Hebrew)Ram Kedem

Exploring Oracle Database Architecture (Hebrew)Ram Kedem

Introduction to SQLRam Kedem

Introduction to DatabasesRam Kedem

Pig - Processing XML dataRam Kedem

SSRS GaugesRam Kedem

SSRS Calculated FieldsRam Kedem

SSRS GroupsRam Kedem

Data Warehouse Design ConsiderationsRam Kedem

Data Warehouse BasicsRam Kedem

Mehr von Ram Kedem (14)

Impala use case @ edge

Advanced SQL Webinar

Managing oracle Database Instance

DDL Practice (Hebrew)

DML Practice (Hebrew)

Exploring Oracle Database Architecture (Hebrew)

Introduction to SQL

Introduction to Databases

Pig - Processing XML data

SSRS Gauges

SSRS Calculated Fields

SSRS Groups

Data Warehouse Design Considerations

Data Warehouse Basics

Kürzlich hochgeladen

A Year of the Servo Reboot: Where Are We Now?Igalia

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge

Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer

Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC

[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745

The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer

Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2

TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc

Driving Behavioral Change for Information Management through Data-Driven Gree...Enterprise Knowledge

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung

The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los

Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko

Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1

Histor y of HAM Radio presentation slidevu2urc

2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong

Scaling API-first – The story of a global engineering organizationRadu Cotescu

08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls

IAC 2024 - IA Fast Track to Search Focused AI SolutionsEnterprise Knowledge

08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls

Kürzlich hochgeladen (20)

A Year of the Servo Reboot: Where Are We Now?

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf

Axa Assurance Maroc - Insurer Innovation Award 2024

Breaking the Kubernetes Kill Chain: Host Path Mount

[2024]Digital Global Overview Report 2024 Meltwater.pdf

The Codex of Business Writing Software for Real-World Solutions 2.pptx

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Exploring the Future Potential of AI-Enabled Smartphone Processors

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

Driving Behavioral Change for Information Management through Data-Driven Gree...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Handwritten Text Recognition for manuscripts and early printed texts

Boost Fertility New Invention Ups Success Rates.pdf

Histor y of HAM Radio presentation slide

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Scaling API-first – The story of a global engineering organization

08448380779 Call Girls In Greater Kailash - I Women Seeking Men

IAC 2024 - IA Fast Track to Search Focused AI Solutions

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

SQL Injections - Oracle

2. Lesson Goals • What is a SQL Injection – basic example • Avoiding SQL Injections • Using Invoker and Definer Rights Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent Ramkedem.com

5. Avoiding SQL Injection • To immunize your code against SQL injection attacks, • Use bind arguments explicitly with dynamic SQL. • Use bind arguments automatically with static SQL. • Validate and sanitize all input concatenated to dynamic SQL (DBMS_ASSERT). • Consider using Invoker’s rights. Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent Ramkedem.com

15. Invoker and Definer rights • Definer’s rights: • Programs execute with the privileges of the creating user. • A user does not require privileges on underlying objects the procedure accesses. • Only requires privilege to execute a procedure. • Invoker’s rights: • Programs execute with the privileges of the calling user. • A user requires privileges on the underlying objects the procedure accesses. • There is no need for duplication of code. A single compiled program unit can be made to use schema A's objects when invoked by User A and schema B's objects when invoked by User B. • This way, we have the option of creating a code repository in one place and sharing it with various production users. Copyright 2014 © Ram Kedem. All rights reserved. Not to be reproduced without written consent Ramkedem.com

SQL Injections - Oracle

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Andere mochten auch

Andere mochten auch (18)

Ähnlich wie SQL Injections - Oracle

Ähnlich wie SQL Injections - Oracle (20)

Mehr von Ram Kedem

Mehr von Ram Kedem (14)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

SQL Injections - Oracle