| Author |
Topic |
|
WolfShade
Starting Member
3 Posts |
 Posted - 2012-02-02 : 19:51:11
|
| I just ran a query that gives public permission to execute (in the master database, 'sys' schema) sp_OASetProperty, sp_OAMethod, sp_OAGetErrorInfo, sp_OADestroy, sp_OAStop, sp_OACreate, and sp_OAGetProperty. How dangerous is this?I did so because of some added RegEx functionality. Very nice RegEx, and I dislike the idea of losing the RegEx objects. But how dangerous (seriously) is it to grant execute permission to public for the above? If it's dangerous, I'll get rid of the RegEx.Thank you,^_^ |
|
|
WolfShade
Starting Member
3 Posts |
Posted - 2012-02-07 : 13:17:14
|
| Anyone? |
 |
|
|
X002548
Not Just a Number
15586 Posts |
|
|
GilaMonster
Master Smack Fu Yak Hacker
4507 Posts |
Posted - 2012-02-07 : 14:03:54
|
| Those are nasty xps. Object automation inside a database... *shudder* If you want to use regex, why not a CLR procedure or function?--Gail ShawSQL Server MVP |
|
|
|
Kristen
Test
22859 Posts |
Posted - 2012-02-07 : 14:06:29
|
I can't help either ... except to say the only time I have enabled them is to do one-off RegEx for some sort of initial data import. Beyond that we've programmed around not having full-flexible RegEx in SQL's "LIKE" expression (much as I would like to have a fully-function RegEx in SQL  ) |
|
|
|
russell
Pyro-ma-ni-yak
5072 Posts |
Posted - 2012-02-07 : 16:34:04
|
| Don't give public permission to sp_OACreate etc.If you have a valid reason to use OLE Automation inside your SPs, just grant execute on those. |
|
|
|
WolfShade
Starting Member
3 Posts |
Posted - 2012-02-08 : 01:17:19
|
| Thanks, everyone. Guess I'll go back and undo all those.GilaMonster: any suggestions on decent CLR that will give good RegEx replace?^_^ |
|
|
|
GilaMonster
Master Smack Fu Yak Hacker
4507 Posts |
Posted - 2012-02-08 : 06:03:48
|
| Sorry, I don't write CLR, but there should be regex features in C#, so should not be hard.--Gail ShawSQL Server MVP |
|
|
|
sunitabeck
Master Smack Fu Yak Hacker
5155 Posts |
Posted - 2012-02-08 : 06:50:25
|
| This article might be useful. Fill Factor also has downloadable code in that article. http://www.simple-talk.com/sql/t-sql-programming/clr-assembly-regex-functions-for-sql-server-by-example/ |
|
|
|
bokerjony
Starting Member
3 Posts |
Posted - 2012-02-22 : 00:20:53
|
| thanks for sharing this topic.unspammed |
|
|
|
|
How safe/dangerous is this?