Some Oracle packages contain powerful SYS-owned functions that can be used to perform malicious operations. For instance, ``++DBMS_SYS_SQL.PARSE_AS_USER++`` can be used to execute a statement as another user.


Most programs do not need those functions and this rule helps identify them in order to prevent security risks.


== Noncompliant Code Example

[source,sql]
----
DECLARE
  c INTEGER;
  sqltext VARCHAR2(100) := 'ALTER USER system IDENTIFIED BY hacker'; -- Might be injected by the user
BEGIN
  c := SYS.DBMS_SYS_SQL.OPEN_CURSOR();                               -- Noncompliant

   -- Will change 'system' user's password to 'hacker'
  SYS.DBMS_SYS_SQL.PARSE_AS_USER(c, sqltext, DBMS_SQL.NATIVE, UID);  -- Non-Compliant

  SYS.DBMS_SYS_SQL.CLOSE_CURSOR(c);                                  -- Noncompliant
END;
/
----


== See

* https://owasp.org/Top10/A04_2021-Insecure_Design/[OWASP Top 10 2021 Category A4] - Insecure Design
* https://cwe.mitre.org/data/definitions/269[MITRE, CWE-269] - Improper Privilege Management
* https://cwe.mitre.org/data/definitions/270[MITRE, CWE-270] - Privilege Context Switching Error


ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::message.adoc[]

include::parameters.adoc[]

'''
== Comments And Links
(visible only on this page)

include::comments-and-links.adoc[]
endif::env-github,rspecator-view[]