QUESTION 64、 invoker’s rights

In your multitenant container database (CDB) that contains pluggable databases (PDBs), the HR user executes the following commands to create and grant privileges on a procedure:
CREATE OR REPLACE PROCEDURE create_test_v (v_emp_id NUMBER, v_ename VARCHAR2,
v_SALARY NUMBER, v_dept_id NUMBER)
BEGIN
INSERT INTO hr.test VALUES (v_emp_id, v_ename, v_salary, v_dept_id);
END;
/
GRANT EXECUTE ON CREATE_TEST to john, jim, smith, king;
How can you prevent users having the EXECUTE privilege on the CREATE_TEST procedure from  inserting values into tables on which they do not have any privileges?
A. Create the CREATE_TEST procedure with definer’s rights.
B. Grant the EXECUTE privilege to users with GRANT OPTION on the CREATE_TEST procedure.
C. Create the CREATE_TEST procedure with invoker’s rights.
D. Create the CREATE_TEST procedure as part of a package and grant users the EXECUTE privilege
the package.
Correct Answer: C

If a program unit does not need to be executed with the escalated privileges of the definer, you should specify that the program unit executes with the privileges of the caller, also known as the invoker. Invoker's rights can mitigate the risk of SQL injection. Incorrect Answers:
A: By default, stored procedures and SQL methods execute with the privileges of their owner, not their current user. Such definer-rights subprograms are bound to the schema in which they reside.
not B: Using the GRANT option, a user can grant an Object privilege to another user or to PUBLIC.

 

在包含可插拔数据库(pdb)的多租户容器数据库(CDB)中，HR用户执行以下命令来创建和授予过程的权限:

CREATE OR REPLACE PROCEDURE create_test_v (v_emp_id NUMBER, v_ename VARCHAR2,
v_SALARY NUMBER, v_dept_id NUMBER)
BEGIN
INSERT INTO hr.test VALUES (v_emp_id, v_ename, v_salary, v_dept_id);
END;
/
GRANT EXECUTE ON CREATE_TEST to john, jim, smith, king;

如何防止拥有CREATE_TEST过程的EXECUTE权限的用户将值插入到他们没有任何权限的表中?

用定义者的权限创建CREATE_TEST过程。

将EXECUTE权限授予CREATE_TEST过程上具有Grant选项的用户。

创建具有调用者权限的CREATE_TEST过程。

D.创建CREATE_TEST过程作为包的一部分，并授予用户EXECUTE权限

包。

正确答案:C

 

如果一个程序单元不需要使用定义器的升级特权来执行，则应该指定该程序单元使用调用者(也称为调用者)的特权来执行。调用者的权限可以降低SQL注入的风险。不正确的答案:

答:默认情况下，存储过程和SQL方法以其所有者的权限执行，而不是以当前用户的权限执行。这样的定义者权限子程序被绑定到它们所在的模式。

不是B:使用GRANT选项，一个用户可以将Object权限授予另一个用户或PUBLIC。