Beginning Microsoft SQL Server 2008 ... - S3 Tech Training

Chapter 12: Stored Procedures
408
feed or stock quote), even though the structure and complex communications required would have
ruled out such a function in prior versions.
Without going into too much detail on them for now, let’s look at the syntax for adding an assembly to
your database:
CREATE ASSEMBLY AUTHORIZATION FROM
WITH PERMISSION_SET = [SAFE | EXTERNAL_ACCESS | UNSAFE]
The CREATE ASSEMBLY part of things works as pretty much all our CREATE statements have — it indicates
the type of object being created and the object name.
Then comes the AUTHORIZATION — this allows you to set a context that the assembly is always to run
under. That is, if it has tables it needs to access, how you set the user or rolename in AUTHORIZATION
will determine whether it can access those tables or not.
After that, we go to the FROM clause. This is essentially the path to your assembly, along with the manifest
for that assembly.
Finally, we have WITH PERMISSION_SET. This has three options:
❑ SAFE: This one is, at the risk of sounding obvious, well . . . safe. It restricts the assembly from
accessing anything that is external to SQL Server. Things like files or the network are not available
to the assembly.
❑ EXTERNAL_ACCESS: This allows external access, such as to files or the network, but requires
that the assembly still run as managed code.
❑ UNSAFE: This one is, at the risk of again sounding obvious, unsafe. It allows your assembly not
only to access external system objects, but also to run unmanaged code.
I cannot stress enough the risks you are taking when running .NET assemblies in
anything other than SAFE mode. Even in EXTERNAL_ACCESS mode you are allowing
the users of your system to access your network, files, or other external resources in
what is essentially an aliased mode — that is, they may be able to get at things that
you would rather they not get at, and they will be aliased on your network to whatever
your SQL Server login is while they are making those accesses. Be very, very
careful with this stuff.
.NET assemblies will be discussed extensively in Professional SQL Server 2008 Programming.