|
From: Meier, S. <s....@re...> - 2008-07-23 10:25:17
|
> > Here is a different approach that we use not for security reasons but > > merely for logging: > > > > Create a wrapper JDBC driver that wraps your original driver. Then > > register this driver instead of the original driver within SQuirreL. > > Any call that SQuirreL sends to the database will then pass through > > the wrapper. Here you'd be in control of everything. If you don't want > > a call to execute simply make the wrapper throw an SQLException. > > SQuirreL should handle such exceptions the way it does any other database exceptions. > > > > To create such a driver wrapper can be simplified a lot using JDKs > > Proxy API. See > > http://java.sun.com/j2se/1.5.0/docs/api/java/lang/reflect/Proxy.html > > > > This has the benefit that it is portable to other JDBC front-ends and you can use the current version of SQuirreL unmodified. Nice! But then you must also prevent the user from changing the driver configuration in SQuirreL to using the original JDBC driver again or creating a new alias with this driver. They could also just use a different SQL-Client that you can download and use without having to install anythin as Administrator (e.g. SQuirrel SQL-Client). It seems to me that the "security" features suggested so far all rely on the end users being not very tech-savvy so they don't know how to deal with JDBC drivers and stuff. I think it would be much more secure to use some kind of middleware and not rely on restrictions built or configured into the client. Perhaps a SQL-proxy would be sufficient to achieve this (if there exists one for your RDBMS). Stefan |
