Calling OS from database JVM: security/privilege escalation issue ?

Hi all

Been looking for a way to call OS commands from the database. Found out MOS id 819366.1 which provides the code required to allow that. To test this solution, I created a
schema and gave it some (pretty common) privileges:

create user mytest identified by mytest;
grant create session, create procedure to mytest;

Unless I'm missing something, I see 2 critical issues with this code:

1) To allow a database user to call OS commands from the database, the following java permission must be granted:

execute dbms_java.grant_permission( 'SCOTT', 'SYS:java.io.FilePermission', '/bin/sh', 'execute' );

From
that point, this seems (based on my tests) to allow the user to call *ANY* shell script (executable by the OS user associated with the parent process of the database connection) from the OS, as long as the user