Dbms_sql in a different schema from query table-error ** ORA-00942

Question

Oracle Experts,
I think I am having problems with using DBMS_SQL in which the function was created in one schema and the query table was created in a different schema.
We have 2 schemas: S1, S2
We have 2 tables:
T1 in Schema S1
T2 in Schema S2
We have a function F1 created by DBA in schema S1 that uses the dbms_sql as:
CREATE OR REPLACE FUNCTION S1.F1(v1 in VARCHAR2) return NUMBER IS
cursor1 INTEGER;
BEGIN
cursor1 := dbms_sql.open_cursor;
dbms_sql.parse(cursor1, v1, dbms_sql.NATIVE);
dbms_sql.close_cursor(cursor1);
return (0);
EXCEPTION
when others then
dbms_sql.close_cursor(cursor1);
return (1) ;
END;
I am using jdeveloper 11G. We have an Oracle DB 11g.
We have a java program which uses jdbc to talk to our Oracle DB.
Basically, in my java program, I call function F1 to check if the query is valid.
If it is, it returns 0. Otherwise, returns 1:
oracle.jdbc.OracleCallableStatement cstmt = (oracle.jdbc.OracleCallableStatement) connection.prepareCall ("begin ? := S1.F1 (?); end;");
cstmt.registerOutParameter (1, java.sql.Types.INTEGER);
cstmt.setString(2, "Select * from S2.T2");
cstmt.execute ();
Since the table that I run the query is T2, created in different schema than F1 was created in, I have the error:
** ORA-00942: table or view does not exist
So my questions are these:
- I am using Oracle DB 11g, if I run the query on a table that created in a different schema from the one that the function (which uses dbms_sql) was created in, I would get the error ORA-00942?
- If I runs the query on table T1 in the same schema as the function F1, would I have the same problem(The reason I ask is I cannot create any table in schema S1 because the DBA has to do it; I am not a DBA)
- This is not a problem, but a security feature because of SQL injection?
- How to resolve this issue other than creating the table in the same schema as the function that utilizes DBMS_SQL?
Regards,
Binh

Answer 1

Definer rights (default) stored objects run under owner's security domain and ignore role based privileges. So regardless what user you are logged in as, function S1.F1 always executes as user S1 and ignores user S1 roles. Therefore exeuting statement within S1.F1:
Select * from S2.T2requires user S1 to have SELECT privilege on S2.T2 granted to S1 directly, not via role.
SY.