Oracle Database 26ai will be available on generic Linux platforms in January and soon on AIX and Windows
Purpose
Creates a PL/SQL admin packages for database firewall.
According to the Beta docs prevents SQL Injection attacks: I am far from confident that the author understands what a SQL Injection attack actually is.
AUTHID
CURRENT_USER
Constants
Name
Data Type
Value
Log Types
CAPTURE_LOG
NUMBER
1
VIOLATION_LOG
NUMBER
2
ALL_LOGS
NUMBER
3
Feature Supported in the Exclude/Include API
SCHEDULER_JOB
NUMBER
1
Add/Delete Context Types
OS_PROGRAM
NUMBER
1
OS_USERNAME
NUMBER
2
IP_ADDRESS
NUMBER
3
Enforce options for Enable Allow List and Update Allow List Enforcement
dbms_sql_firewall.append_allow_list_single_sql(
username IN VARCHAR2,
sql_signature IN VARCHAR2,
current_user IN VARCHAR2,
top_level IN VARCHAR2,
source IN NUMBER
DEFAULT
sys.dbms_sql_firewall.violation_log);
Enable SQL Firewall allow-list enforcement for a user
dbms_sql_firewall.enable_allow_list(
username IN VARCHAR2,
enforce IN NUMBER DEFAULT sys.dbms_sql_firewall.enforce_all,
block IN BOOLEAN DEFAULT FALSE);
dbms_sql_firewall.purge_log(
username IN VARCHAR2 DEFAULT NULL,
purge_time IN TIMESTAMP WITH TIME ZONE DEFAULT NULL,
log_type IN NUMBER DEFAULT dbms_sql_firewall.all_logs);
INSERT INTO c##applic.credit_cards
VALUES ('4123-5678-9012-3456',
SYSDATE+30, '359', 5000);
INSERT INTO c##applic.credit_cards
VALUES ('5890-1234-5678-9123',
SYSDATE+45, '892', 10000);
INSERT INTO c##applic.credit_cards
VALUES ('6574-3521-8805-7492', SYSDATE+120, '461', 25000);
COMMIT;
GRANT SELECT ON c##applic.credit_cards TO c##exploiter;
CREATE USER c##exploiter
IDENTIFIED BY exploiter
DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp
QUOTA 100M ON users
PROFILE DEFAULT;
Grant succeeded.
conn / as sysdba
exec dbms_sql_firewall.enable;
PL/SQL procedure successfully completed.
-- required if previously created / nightmare material
exec dbms_sql_firewall.disable_allow_list('C##EXPLOITER');
exec dbms_sql_firewall.drop_allow_list('C##EXPLOITER');
SELECT sql_text FROM dba_sql_firewall_capture_logs;
SQL_TEXT
------------------------------------------------------------------------------------
ALTER SESSION SET QUERY_REWRITE_INTEGRITY=TRUSTED
SELECT SUBSTR (CREDIT_CARD_NUMBER,:"SYS_B_0",:"SYS_B_1") AS FINAL_FOUR FROM C##APPLIC.CREDIT_CARDS
ALTER SESSION SET QUERY_REWRITE_INTEGRITY=ENFORCED
DESCRIBE C##APPLIC.CREDIT_CARDS
SELECT COUNT (*) FROM C##APPLIC.CREDIT_CARDS
SELECT DECODE (USER,:"SYS_B_0",XS_SYS_CONTEXT
(:"SYS_B_1",:"SYS_B_2"),USER) FROM SYS.DUAL
SELECT username, command_type, accessed_objects, current_user, top_level, ip_address
FROM dba_sql_firewall_capture_logs;
USERNAME COMMAND_TYPE ACCESSED_OBJECTS
CURRENT_USER TOP_LEVEL IP_ADDRESS
------------ ------------- -------------------------- ------------ --------- ----------
C##EXPLOITER ALTER SESSION C##EXPLOITER Y Local
C##EXPLOITER SELECT "C##APPLIC"."CREDIT_CARDS" C##EXPLOITER Y Local
C##EXPLOITER ALTER SESSION C##EXPLOITER Y Local
C##EXPLOITER DESCRIBE "C##APPLIC"."CREDIT_CARDS" C##EXPLOITER Y Local
C##EXPLOITER SELECT "C##APPLIC"."CREDIT_CARDS" C##EXPLOITER Y Local
C##EXPLOITER SELECT "SYS"."DUAL" C##EXPLOITER Y Local
SELECT sql_text FROM dba_sql_firewall_allowed_sql;
SQL_TEXT
---------------------------------------------------------------------------------------
ALTER SESSION SET QUERY_REWRITE_INTEGRITY=TRUSTED
SELECT SUBSTR (CREDIT_CARD_NUMBER,:"SYS_B_0",:"SYS_B_1") AS FINAL_FOUR FROM C##APPLIC.CREDIT_CARDS
ALTER SESSION SET QUERY_REWRITE_INTEGRITY=ENFORCED
DESCRIBE C##APPLIC.CREDIT_CARDS
SELECT COUNT (*) FROM C##APPLIC.CREDIT_CARDS
SELECT DECODE (USER,:"SYS_B_0",XS_SYS_CONTEXT (:"SYS_B_1",:"SYS_B_2"),USER) FROM SYS.DUAL
