Oracle APEX 安全提示？
由于要进行安全测试，我有一套基于 Oracle Apex 的应用程序。有人对我应该寻找什么来加强事情有任何建议吗？
I have a suite of Oracle Apex based applications due to have a security test. Does anyone have any tips on what I should look for to tighten things up?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
Apex 应用程序的问题在于底层代码全部是 PL/SQL，因此影响 Apex 应用程序的主要漏洞类别是 SQL 注入也就不足为奇了。
您需要确保不使用替换变量（例如＆P1_TEST），因为这些变量几乎总是会导致可利用的注入。当它们在 PL/SQL 开始/结束块中使用时，注入非常“强大”，因为攻击者可以指定任意数量的 PL/SQL 语句。
许多 Apex 应用程序通过直接调用 EXECUTE IMMEDIATE 或通过 Apex FUNCTION_RETURNING_SQL 块使用动态 SQL（其中在字符串中构造查询然后执行）。动态 SQL 几乎总是一个坏主意。
您还会在 Apex 应用程序中发现相当多的跨站点脚本，其中来自用户的输入或针对数据库运行的查询不会被转义。各种 Apex 报告提供了启用转义的设置，但在定义报告时可能尚未选择这些设置。
还要考虑访问控制模型并确保所有页面都受到适当的授权方案的保护。如果您要存储上传内容，请不要使用 APEX_APPLICATION_FILES 表，因为这不能防止未经身份验证的下载。
希望有帮助，祝你好运！
The thing with Apex applications is that the underlying code is all PL/SQL, so it is no surprise that the major class of vulnerability affecting Apex application is SQL Injection.
You need to make sure that you do not use substitution variables (e.g. &P1_TEST.) as these almost always lead to exploitable injection. When they are used within PL/SQL begin/end blocks the injection is very "powerful" as an attacker can specify an arbitrary number of PL/SQL statements.
Many Apex apps use dynamic SQL (where a query is constructed in a string and then executed), either through direct calls to EXECUTE IMMEDIATE or through Apex FUNCTION_RETURNING_SQL blocks. Dynamic SQL is almost always a bad idea.
You'll also find quite a bit of Cross-Site Scripting in Apex apps, where input from users, or from queries run against the database is not escaped. The various Apex reports provide settings to enable escaping but these may not have been chosen when the report was defined.
Also consider the access-control model and ensure all the pages are protected with appropriate authorisation schemes. Do not use the APEX_APPLICATION_FILES table if you're storing uploads as that doesn't protect against unauthenticated downloads.
Hope that helps, and good luck!