SAP NetWeaver AS ABAP Release 751, ©Copyright 2017 SAP AG. All rights reserved.
ABAP - Keyword Documentation → ABAP - Security Notes →Security Risks Caused by Input from Outside
Most security issues in ABAP programs are caused by because input injected into a program from outside, that is
is used wrongly or carelessly. More specifically, security risks arise here whenever full statements, parts of statements, or objects accessed in statements are specified dynamically and hence are not subject to static checks. Dynamically specified items of this nature occur, for example, in the following cases:
Two main cases must be distinguished here:
If assuming that the developer of a program does so without malicious intent, dynamically specified objects are uncritical in the former case.
The latter case, on the other hand, is critical. If external input is specified dynamically in an ABAP statement without being checked or masked, damage can be incurred (whether unintentional or malicious). The damage can range from exceptions being raised, the absence of system resources (Denial of Service attacks), to the manipulation of persistent data.
The following sections provide examples of the most significant security risks when input from outside is used in statements:
The global principle in these sections of always checking and/or masking external input also applies in all cases not listed separately here, such as using a dynamic WHERE condition when accessing internal tables.
Note
Back doors, implemented by malicious developers using dynamically specified information, are not discussed here. These cannot be checked statically, since they do not originate outside the program, and are not usually classified as dangerous by static checks. The two-man rule code inspections are probably the only solution here. See also Obscuring ABAP Source Code.