Feed aggregator
CodeSOD: The Bob Procedure
Joe recently worked on a financial system for processing loans. Like many such applications, it started its life many, many years ago. It began as an Oracle Forms application in the 90s. By the late 2000s, Oracle was trying to push people away from forms into their newer tools, like Oracle ApEx (Application Express), but this had the result of pushing people out of Oracle's ecosystem and onto their own web stacks.
The application Joe was working on was exactly that. Now, no one was going to migrate off of an Oracle database, especially because 90% of their business logic was wired together out of PL/SQL packages. But they did start using Java for developing their UI, and then at some other point, started using Liquibase for helping them maintain and manage their schema.
The thing about a three decade old application is that it often collects a lot of kruft. For example, this procedure:
CREATE OR REPLACE PROCEDURE BOB(p_str IN VARCHAR2) AS BEGIN dbms_output.put_line(p_str); END;Bob here is just a wrapper around a basic print statement. Presumably, the original developer- I'm gonna go out on a limb and guess that dev was also named Bob- wanted a convenient debugging function while tracking down an error, and threw this into the codebase.
As WTFs go, the function isn't that interesting. But you know what is interesting? Its legacy. This procedure is older than any source control history the company has, which means it's been in the codebase for at least twenty years, but probably much longer. Nothing invokes it. It's survived a migration into SVN then into Git, countless database upgrades, a few (unfortunate) disaster recovery events, and still sits there, waiting to help Bob debug a problem in the database.
Joe writes:
I still don't know who Bob is. Nobody knew who Bob was when I asked around. But Bob, if you're still out there, just know that you are now cemented into a part of the software that hundreds of companies used to manage loans.
[Advertisement] Plan Your .NET 9 Migration with ConfidenceYour journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!
Android 'Pixnapping' Attack Can Capture App Data Like 2FA Codes
Read more of this story at Slashdot.
SpaceX Starship Hits Key Milestones Before Stunning Splashdown
Read more of this story at Slashdot.
Major US Online Retailers Remove Listings For Millions of Prohibited Chinese Electronics
Read more of this story at Slashdot.
Palmer Luckey's Anduril Launches EagleEye Military Helmet
Read more of this story at Slashdot.
Britain Issues First Online Safety Fine To US Website 4chan
Read more of this story at Slashdot.
Google's Nano Banana AI-Image Editing Is Coming to Search, NotebookLM and Photos
Read more of this story at Slashdot.
Dutch Government Takes Control of China-Owned Chipmaker Nexperia
Read more of this story at Slashdot.
Software Update Bricks Some Jeep 4xe Hybrids Over the Weekend
Read more of this story at Slashdot.
Carmakers Chose To Cheat To Sell Cars Rather Than Comply With Emissions Law, 'Dieselgate' Trial Told
Read more of this story at Slashdot.
TP-Link Makes History With First Successful Wi-Fi 8 Connection
Read more of this story at Slashdot.
China Is Shipping More Open AI Models Than US Rivals as Tech Competition Shifts
Read more of this story at Slashdot.
Three New California Laws Target Tech Companies' Interactions with Children
Read more of this story at Slashdot.
Does the Internet Have a Philly Accent? Why Too Much Time Online Can Make You 'Culturally Philadelphian.'
Read more of this story at Slashdot.
Earth's Climate Has Passed Its First Irreversible Tipping Point and Entered a 'New Reality'
Read more of this story at Slashdot.
The Pope Urges Vigilance About Who Controls AI
Read more of this story at Slashdot.
OpenAI, Broadcom Forge Multibillion-Dollar Chip-Development Deal
Read more of this story at Slashdot.
Hollywood Demands Copyright Guardrails from Sora 2 - While Users Complain That's Less Fun
Read more of this story at Slashdot.
Flatpak Doesn't Work in Ubuntu 25.10, But a Fix is Coming
Read more of this story at Slashdot.
CodeSOD: The File Transfer
SQL Server Information Services is Microsoft's ETL tool. It provides a drag-and-drop interface for describing data flows from sources to sinks, complete with transformations and all sorts of other operations, and is useful for migrating data between databases, linking legacy mainframes into modern databases, or doing what most people seem to need: migrating data into Excel spreadsheets.
It's essentially a full-fledged scripting environment, with a focus on data-oriented operations. The various nodes you can drag-and-drop in are database connections, queries, transformations, file system operations, calls to stored procedures, and so on. It even lets you run .NET code inside of SSIS.
Which is why Lisa was so surprised that her predecessor had a "call stored procedure" node called "move file". And more than that, she was surprised that the stored procedure looked like this:
if (@doDelete = 1) begin set @cmdText = 'mv -f ' + @pathName + @FileName + @FileExt + ' ' + @pathName + 'archive\' + @FileName + @FileExt + '.archive' end else begin set @cmdText = 'cp -f ' + @pathName + @FileName + @FileExt + ' ' + @pathName + 'archive\' + @FileName + @FileExt + '.archive' end insert into #cmdOutput exec @cmdResult = master.dbo.xp_cmdshell @cmdTextThis stored procedure was called from SSIS, which again, I want to stress, has the functionality to do this without calling a stored procedure. But this approach offers us a few unique "advantages".
First, it requires xp_cmdshell be enabled. This particular stored procedure is disabled by default, since it allows a user inside of SQL Server to invoke shell commands. Microsoft disables this by default, because it's a gaping security hole. Any security scanning tool you may run against your server will call it out as a big red flag. You're one SQL Injection attack away from an old rm -rf /.
Which, speaking of rm, you'll note the command strings they build to execute. mv and cp. Now, SQL Server can run on Linux, but this instance wasn't. No, the person responsible for this stored procedure also installed GNU Core Utils on Windows, just so they could have mv and cp to invoke from this stored procedure. Even better, they didn't document this dependency, so the first time someone tried to migrate the database to new hardware, this functionality broke and no one knew why.
At least the migration gave them a chance to update their SSIS packages to use the "File Transfer Task" instead of this stored procedure. But don't worry, there were plenty of other stored procedures using xp_cmdshell.
[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.