Protect data in utPLSQL tables #922
Description
Description
The following utPLSQL tables are exposed directly:
| Table Name | Comment |
|---|---|
| DBMSPCC_BLOCKS | select, insert, update, delete to public |
| DBMSPCC_RUNS | select, insert, update, delete to public |
| DBMSPCC_UNITS | select, insert, update, delete to public |
| UT_ANNOTATION_CACHE | select to public |
| UT_ANNOTATION_CACHE_INFO | select to public |
| UT_COMPOUND_DATA_DIFF_TMP | select, insert, update, delete to public |
| UT_COMPOUND_DATA_TMP | select, insert, update, delete to public |
| UT_SUITE_CACHE | select to public |
| UT_SUITE_CACHE_AFTER_ALL | select to public |
| UT_SUITE_CACHE_AFTER_EACH | select to public |
| UT_SUITE_CACHE_AFTER_TEST | select to public |
| UT_SUITE_CACHE_BEFORE_ALL | select to public |
| UT_SUITE_CACHE_BEFORE_EACH | select to public |
| UT_SUITE_CACHE_BEFORE_TEST | select to public |
| UT_SUITE_CACHE_PACKAGE | select to public |
| UT_SUITE_CACHE_SCHEMA | select to public |
| UT_SUITE_CACHE_TRHOWS | select to public |
| UT_SUITE_CACHE_WARNINGS | select to public |
In a shared environment these tables may contain sensitive data. At least some dictionary data is exposed to all users in the database which are otherwise not available. Hence the data must be protected.
Direct access to these tables must be revoked (as already done e.g. for PLSQL_PROFILER_DATA or UT_DBMS_OUTPUT_CACHE).
Furthermore the access to data of these tables must be granted to the owner of the tests and test runs only.
utPLSQL Version
v3.1.7.2935-develop