ABAP Security at TechEd 2013 – Scan, Analyze, and Fix Your Programs!

In workshop SIS261 at this years TechEds you will learn about possible vulnerabilities in ABAP code and you will also learn a new way of finding and fixing them.

ABAP and Security

Security issues in ABAP?  Isn’t that handled by SAP, so nothing to worry about as an ABAP developer? Unfortunately this is not the case. As pointed out in a blog and more detailed in the documentation code injections and insufficient authority checks can become serious security risks also in ABAP programs. The following code snippet shows a prominent example:

DATA customers TYPE TABLE OF scustom WITH EMPTY KEY.

DATA name TYPE string.
cl_demo_input=>request( CHANGING field = name ).

DATA(cond) = `country = ‘DE’ AND name = ‘` && name && `’`.

TRY.
    SELECT * FROM scustom
             INTO TABLE customers
             WHERE (cond).
    cl_demo_output=>display( customers ).
  CATCH cx_sy_dynamic_osql_syntax.
    cl_demo_output=>display( ‘Wrong input’ ).
ENDTRY.

A field name that is delivered from the outside of a program is directly concatenated into a dynamic token of Open SQL.The vulnerability is a potential SQL Injection. If “x’ OR name <> ‘” is entered for name, all the data from the SCUSTOM table is displayed.

Fixing Programs

The workshop will show you ways how to fix your programs. In the above example you can replace

DATA(cond) = `country = ‘DE’ AND name = ‘` && name && `’`.

with

DATA(cond) = `country = ‘DE’ AND name = ‘` &&

             cl_abap_dyn_prg=>escape_quotes( name ) && `’`.

to prevent a potential SQL Injection.

But how to find potential security risks?

Scanning and Analyzing programs

With Releases 7.0, EhP2, SP14, Release 7.3, EhP1, SP09 and Release 7.40, SP05 SAP plans to deliver a SAP NetWeaver Application Server, add-on for code vulnerability analysis that can be purchased as a separate product. This tool will be embedded in the well known Extended Program Check (SLIN) and herewith in the ABAP Test Cockpit (ATC) that also becomes available for customers.

These Security Tests carry out a static data flow analysis and will find such vulnerabilities as shown above.

The integration into ATC looks as follows:

Checks can be carried out during development and findings can be analyzed by the developer. Each message is accompanied by a long text with further information that points out how to fix a problem.

You can setup your system in such a way that transports cannot be realeased as long as security risks are found in programs to be transported.

Want to learn more?  Hope to see you at TechEd in workshop SIS261!