Tom,

Workink now on security issues on our project, I carefully read previous "asktom" questions and articles regarding SQL Injection but I didn't find something similar to the situation bellow:

I have applied as much as possible static SQL on our PL/SQL code and also bind variables in 99% of the cases where dynamic SQL is used.
However under the given design and requirements there still is a portion which worries me: couple of PL/SQL function/procedures have one of the input arguments in a form of a whole block of WHERE clause, as in following pseudocode example:

TYPE refCursor IS REF CURSOR;

create or replace function (arg1 IN VARCHAR2,
arg2 IN VARCHAR2,
v_where IN VARCHAR2)
RETURN refCursor
IS

sql_stmt VARCHAR2(4000);
c refCursor;

begin
if v_where is null then
sql_stmt := 'SELECT ... FROM table1 WHERE field1 = :1
AND field2 = :2 ';
open c for sql_stmt using arg1, arg2;

else
sql_stmt := 'SELECT ... FROM table1 WHERE field1 = :1
AND field2 = :2
/* And here could be the problem !!! */
AND ' || v_where;

open c for sql_stmt using arg1, arg2;

end if;

return c;
end;

The v_where argument can be any field/condition (of course any other than field1 and field2) in any number and any unpredictable combination, so don't ask me to redesign the application to do these things in another way 'cause is out of my posibilities.

Therefore I had to concatenate it, potentially dangerous for SQL injection.
Now, the function, as we can see, only returns a cursor to java, it doesn't have neither EXECUTE IMMEDIATE inside, nor 'SELECT INTO ... WHERE ... '.

Is this function (or procedure like this) exposed to SQL Injection or not ?
I tried to build some hacking scenarios but I couldn't.
In my opinion it is not exposed.

Thank you for your help.