In workshop SIS261 at this years TechEds you will learn about possible vulnerabilities in ABAP code and you will also learn a new way of finding and fixing them.
ABAP and Security
Security issues in ABAP? Isn't that handled by SAP, so nothing to worry about as an ABAP developer? Unfortunately this is not the case. As pointed out in a blogand more detailed in the documentation code injections and insufficient authority checks can become serious security risks also in ABAP programs. The following code snippet shows a prominent example:
DATA customers TYPE TABLE OF scustom WITH EMPTY KEY.
DATA name TYPE string.
cl_demo_input=>request( CHANGING field = name ).
DATA(cond) = `country = 'DE' AND name = '` && name && `'`.
TRY.
SELECT * FROM scustom
INTO TABLE customers
WHERE (cond).
cl_demo_output=>display( customers ).
CATCH cx_sy_dynamic_osql_syntax.
cl_demo_output=>display( 'Wrong input' ).
ENDTRY.
A field name that is delivered from the outside of a program is directly concatenated into a dynamic token of Open SQL.The vulnerability is a potential SQL Injection. If "x' OR name <> '" is entered for name, all the data from the SCUSTOM table is displayed.
Fixing Programs
The workshop will show you ways how to fix your programs. In the above example you can replace
DATA(cond) = `country = 'DE' AND name = '` && name && `'`.
with
DATA(cond) = `country = 'DE' AND name = '` &&
cl_abap_dyn_prg=>escape_quotes( name ) && `'`.
to prevent a potential SQL Injection.
But how to find potential security risks?
Scanning and Analyzing programs
With Releases 7.0, EhP2, SP14, Release 7.3, EhP1, SP09 and Release 7.40, SP05 SAP plans to deliver a SAP NetWeaver Application Server, add-on for code vulnerability analysis that can be purchased as a separate product. This tool will be embedded in the well known Extended Program Check (SLIN) and herewith in the ABAP Test Cockpit (ATC) that also becomes available for customers.
These Security Tests carry out a static data flow analysis and will find such vulnerabilities as shown above.
The integration into ATC looks as follows:
Checks can be carried out during development and findings can be analyzed by the developer. Each message is accompanied by a long text with further information that points out how to fix a problem.
You can setup your system in such a way that transports cannot be realeased as long as security risks are found in programs to be transported.
Want to learn more? Hope to see you at TechEd in workshop SIS261!