The Oracle® Hacker's Handbook: Hacking and Defending Oracle

12.4. Java and the Network

You can, of course, use Java to connect out the network using sockets or other prepackaged network classes like URL, but to do so the user needs the connect and resolve java.net.SocketPermission:

exec dbms_java.grant_permission( 'SCOTT',
'SYS:java.net.SocketPermission','*', 'connect, resolve');

Once you have this, you can connect out to any host — this is indicated with the asterisk in the preceding statement. The following code uses the URL class to enable you to connect out to web servers:

CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "JAVAURL" AS
import java.lang.*;
import java.io.*;
import java.net.*;

public class JAVAURL
{
      public static void getUrl (String purl) throws IOException
      {
              try
              {
                  URL url = new URL(purl);
                  InputStream is = url.openStream();
                  BufferedInputStream bis = new BufferedInputStream(is);
                  int page;

                  while(true)
                  {
                        page = bis.read();
                        if(page == −1)
                              break;
                        System.out.print((char)page);
                  }
           }
           catch (MalformedURLException mue)
           {
                 System.err.println ("Invalid URL");
           }
           catch (IOException io)
           {

System.err.println ("Read Error — " + io);
           }
      }
};
/
show errors
CREATE OR REPLACE PROCEDURE JAVAURLPROC (purl IN VARCHAR2)
AS LANGUAGE JAVA
NAME 'JAVAURL.getUrl (java.lang.String)';
/
set serveroutput on
exec dbms_java.set_output(2000);
exec javaurlproc('http://www.databasesecurity.com/');