Enhancing Security - Expert Oracle and Java Security - page 294

Listing 11-32. Count Connection Strings Stored for Current Version
stmt = ( OracleCallableStatement )conn.prepareCall(
"CALL appsec.appsec_only_pkg. p_count_class_conns (?,?,?)" );
stmt.registerOutParameter( 3, OracleTypes.NUMBER );
stmt.setString( 1, className );
stmt.setString( 2, classVersion );
stmt.setInt( 3, 0 );
stmt.executeUpdate();
boolean okToOverwrite = false;
if( stmt.getInt( 3 ) == 0 ) {
// Do insert!
okToOverwrite = true ;
} else {
If an entry exists in the database, we will assure that the inner class instance that we provided as an
argument to this method is the same as what is stored. We do this by simply getting an object from the
stored bytes based on the current class name and version (see Listing 11-33). Recall that the Java class
loader cannot load two substantially different classes by the same name; a runtime exception would be
thrown.
Listing 11-33. Get Connection Strings and Class Stored for Current Version
stmt = ( OracleCallableStatement )conn.prepareCall(
"CALL appsec.appsec_only_pkg. p_get_class_conns (?,?,?,?)" );
stmt.registerOutParameter( 3, OracleTypes.RAW );
stmt.registerOutParameter( 4, OracleTypes.BLOB );
stmt.setString( 1, className );
stmt.setString( 2, classVersion );
stmt.setNull( 3, OracleTypes.RAW );
stmt.setNull( 4, OracleTypes.BLOB );
stmt.executeUpdate();
byte[] cachedBytes = stmt.getBytes(3);
oins = new ObjectInputStream( new ByteArrayInputStream(
cachedBytes ) );
classObject = oins.readObject() ;
oins.close();
When we read the object from the ObjectInputStream , it had better be identical to the object we
passed as the classInstance argument to this method; otherwise an InvalidClassException will be
thrown. For good measure, we get a class instance from the object and test to see if it is equal to the class
we got earlier in Listing 11-34. If it's not, we would have already failed (unless the inner class name is
different, in which case it shouldn't be stored in the database with this name).
Listing 11-34. Test Stored Class and Connection Strings
Class testClass = classObject.getClass();
if( testClass != providedClass )
return "Failed to setDecryptConns";