How to store a binary file as function module

Hello Jan,

thank you for your reply.

I must confess that I still not understand your arguments.

You can execute the content of the MIME repository also easily, here an example:

Function Test.
*"----------------------------------------------------------------------
*"*"Local Interface:
*"----------------------------------------------------------------------

  "-Variables-----------------------------------------------------------
    Data l_File Type XString.
    Data l_rif_MR_API Type Ref To if_mr_api.
    Data l_url Type String Value '/sap/public/components/test.exe'.
    Data l_WorkDir Type String.
    Data l_FileName Type String Value 'Test.exe'.
    Data l_FilePath Type String.
    Data l_dTab Type Table Of x255.
    Data l_len Type i.

  "-Binary File---------------------------------------------------------
    If l_rif_MR_API Is Initial.
      l_rif_MR_API = cl_mime_repository_api=>if_mr_api~get_api( ).
    EndIf.

    Call Method l_rif_MR_API->get
      Exporting i_url = l_url
      Importing e_content = l_File
      Exceptions Others = 1.

  "-Get path of SAP work directory--------------------------------------
    Call Method cl_gui_frontend_services=>get_sapgui_workdir
      Changing
        SAPWORKDIR = l_WorkDir
      Exceptions
        Others = 1.

  Concatenate l_WorkDir '\' l_FileName Into l_FilePath.

  "-Store file----------------------------------------------------------
    Call Function 'SCMS_XSTRING_TO_BINARY'
      Exporting
        BUFFER = l_File
      Importing
        OUTPUT_LENGTH = l_len
      Tables
        BINARY_TAB = l_dTab.

    Call Function 'GUI_DOWNLOAD'
      Exporting
        BIN_FILESIZE = l_len
        FILENAME = l_FilePath
        FILETYPE = 'BIN'
      Tables
        DATA_TAB = l_dTab
      Exceptions
        Others = 1.

  "-Execute file--------------------------------------------------------
    Call Method cl_gui_frontend_services=>execute
      Exporting
        DOCUMENT = l_FilePath
      Exceptions
        Others = 1.

EndFunction.

Let us determine, it is no difference where the content is stored. As I show in my example above, you can use the same method with the MIME repositoy.

I think it is a question of the use case to decide if an "injection" of something should be execute on the frontend server or not. You can't say generally that should not be executable.

So last but not least in my eyes your argument is that an eventually attacker can use his chance with the command cl_gui_frontend_services=>execute, indenpendently where the content is stored. But this risk is always present, it is no special problem of this method.

Let us look to one of my use cases:

I embed a PDF in a function module and if the user press a button on the screen the file is downloaded and executed with the local installed Acrobat viewer.

In this function module is my user name, the creation date and the date of the last modification date stored. If something is suspicious with the content of the file the local security system of the frontend server will detect and prevent this activities. The chance to attack a frontend server on this way is considered optimistic near by null, also the backend server - and why should I attack a backend server where my function module is executed, it is going easier.

Therefore, it is all SAP standard, no tricks and I don't understand your security reason arguments furthermore.

Cheers

Stefan