Search Results validate_arg




Overview
Explore in AI Chat

Overview

SYS.OWA_UTIL is the Oracle-supplied PL/SQL package that provides the core web toolkit used by the Oracle Application Server (mod_plsql / PL/SQL Gateway) and embedded web services throughout Oracle E-Business Suite. In the EBS 12.1.1 and 12.2.2 environments, the package is owned by SYS and classified as a UTIL API. It supplies the low-level primitives that let a PL/SQL stored procedure behave as a web application: writing HTTP headers and MIME types, emitting HTML tables, invoking redirects and status lines, reading CGI environment values, and rendering the source of PL/SQL objects for diagnostic pages. The ETRM excerpt confirms the source ships as version owa_version CONSTANT varchar2(64) := '10.1.2.1.9', which situates it in the 10.1.0.2 database line bundled with the EBS 12.1/12.2 technology stack.

A relevant searched symbol, validate_arg, is defined here. It is a defensive string-sanitisation function used to prepare values destined for HTTP headers and cookies. The documented implementation returns the input unchanged when NULL, then truncates the value at the first occurrence of either the newline character (NL_CHAR, drawn from owa_cx.nl_char) or carriage return (CR_CHAR, chr(13)). This prevents CR/LF injection (HTTP response splitting) when user-supplied data is echoed into headers.

Key Procedures and Functions

The documented API exposes 55 procedures and functions. The principal ones in the ETRM metadata are:

  • validate_arg — Sanitises a string for use in HTTP headers/cookies by stripping everything from the first newline or carriage return onward.
  • NAME_RESOLVE — Resolves a stored object name against the data dictionary so it can be rendered or referenced by a web page.
  • SHOWSOURCE / SIGNATURE — Render the source text and the call signature of a PL/SQL object for developer diagnostic pages.
  • SHOWPAGE — Retrieves and displays an arbitrary database page/object referenced by name or URL.
  • GET_CGI_ENV / PRINT_CGI_ENV — Read a single CGI environment variable and print the full environment set.
  • MIME_HEADER / REDIRECT_URL / STATUS_LINE / HTTP_HEADER_CLOSE — Emit the HTTP response envelope: content type, redirect to another URL, status code, and header termination.
  • GET_OWA_SERVICE_PATH — Return the virtual path of the OWA service handling the request.
  • SHOW_QUERY_COLUMNS — Print the column definitions produced by a query.
  • TABLEPRINT — Render an entire result set as an HTML table.
  • COMMA_TO_IDENT_ARR — Convert a comma-delimited string into a PL/SQL identifier array.
  • TABLEOPEN / TABLECAPTION / TABLEHEADERROWOPEN / TABLEHEADER / TABLEHEADERROWCLOSE / TABLEROWOPEN — Granular table-rendering primitives that let callers build HTML tables tag by tag, interleaving data rows with formatted markup.

Tables Accessed

The ETRM metadata lists no APPS synonyms or base tables referenced by this package. NAME_RESOLVE and SHOWSOURCE rely on data dictionary views (such as DBA_SOURCE, DBA_OBJECTS and DBA_PROCEDURES) through internal dictionary queries rather than application tables, which is consistent with its classification as a generic utility rather than a functional API. The excerpt further shows IS_TABLE using DBMS_SQL with DBMS_SYS_SQL.PARSE_AS_USER to test object existence, confirming that dictionary/object metadata — not business data — is the target of its reads.

Usage Notes

OWA_UTIL is invoked automatically by the PL/SQL Gateway whenever an EBS procedure acts as a web entry point, and it is referenced directly by custom JSP/PLSQL pages and by other PL/SQL packages (the metadata reports it is referenced by eight other packages). Typical call sites include:

  • Custom OWA/PLSQL pages in EBS that write their own MIME_HEADER, REDIRECT_URL or STATUS_LINE output.
  • Developer and administrator diagnostic pages that call SHOWSOURCE, SIGNATURE and SHOWPAGE.
  • Report or form-driven integrations that render ad hoc result sets with TABLEPRINT or the TABLE* family.
  • Any code emitting user input into headers or cookies, which should pass values through validate_arg first to defeat newline-injection attacks.

Because the package is owned by SYS and lives in the core database, custom code should invoke it only through the standard EXECUTE grants rather than attempting to modify it. Its presence in both 12.1.1 and 12.2.2 reflects the shared 10.1.0.2 technology stack across those EBS releases.