Enhancing Security - Expert Oracle and Java Security - page 293

String className = providedClass.getName() ;
Method classMethod = providedClass.getMethod( "getRevLvl" ) ;
String classVersion = ( String )classMethod.invoke( classObject );
Next, we want to get an idea of how this is going to go. Do we really have anything to copy? We get
the list of connection strings using the current inner class name, which we just got from the Object , and
using the previous version name that was passed here in the prevVersion parameter. (See Listing 11-30.)
By passing those arguments (1 and 2) to the stored procedure p_get_class_conns , we can get back the
list of connection strings (OUT parameter 4) for the previous version of our inner class (OUT parameter
3). If we get a null back for our previous inner class, then there is nothing to copy, so we return.
Listing 11-30. Select Connection Strings for Previous Version
stmt = ( OracleCallableStatement )conn.prepareCall(
"CALL appsec.appsec_only_pkg. p_get_class_conns (?,?,?,?)" );
stmt.registerOutParameter( 3, OracleTypes.RAW );
stmt.registerOutParameter( 4, OracleTypes.BLOB );
stmt.setString( 1, className );
stmt.setString( 2, prevVersion );
stmt.setNull( 3, OracleTypes.RAW );
stmt.setNull( 4, OracleTypes.BLOB );
stmt.executeUpdate();
if( null == stmt.getBytes( 3 ) ) return "Nothing to copy";
Listing 11-31 shows another application of our new f_unmask Oracle stored function. Now that we
are encrypting the connection strings as we store them on disk, we need to also decrypt them as we read
them from storage.
Listing 11-31. Decrypt Connection Strings from Previous Version
byte[] prevConnsBytes = stmt.getBytes(4);
stmt = ( OracleCallableStatement )conn.prepareCall(
"{? = call appsec. f_unmask (?,?,?)}" );
stmt.registerOutParameter( 1, OracleTypes.RAW );
stmt.setBytes( 2, prevConnsBytes );
stmt.setString( 3, className );
stmt.setString( 4, prevVersion );
stmt.executeUpdate();
prevConnsBytes = stmt.getBytes(1) ;
We read the decrypted bytes for our list of application connection strings, but we do not need to
assemble a HashMap object to represent the list; rather, we will be storing the byte array as-is for the new
version.
However, before we proceed to copy our list of connection strings to the new version, we will assure
we are not overwriting an existing list. We will call the p_count_class_conns procedure for the current
inner class name and version to see if an entry exists in the database (see Listing 11-32). If none exists,
then we are okay to insert; otherwise, we need to examine the list of connection strings that exists for the
new version of the application.