Skip to Content
Author's profile photo Horst Keller

ABAP Security at TechEd 2013 – Scan, Analyze, and Fix Your Programs!

In workshop SIS261 at this years TechEds you will learn about possible vulnerabilities in ABAP code and you will also learn a new way of finding and fixing them.

ABAP and Security

Security issues in ABAP?  Isn’t that handled by SAP, so nothing to worry about as an ABAP developer? Unfortunately this is not the case. As pointed out in a blog and more detailed in the documentation code injections and insufficient authority checks can become serious security risks also in ABAP programs. The following code snippet shows a prominent example:


DATA name TYPE string.
cl_demo_input=>request( CHANGING field = name ).

DATA(cond) = `country = ‘DE’ AND name = ‘` && name && `’`.

    SELECT * FROM scustom
             INTO TABLE customers
             WHERE (cond).
    cl_demo_output=>display( customers ).
  CATCH cx_sy_dynamic_osql_syntax.
    cl_demo_output=>display( ‘Wrong input’ ).

A field name that is delivered from the outside of a program is directly concatenated into a dynamic token of Open SQL.The vulnerability is a potential SQL Injection. If x’ OR name <> ‘” is entered for name, all the data from the SCUSTOM table is displayed.

Fixing Programs

The workshop will show you ways how to fix your programs. In the above example you can replace

DATA(cond) = `country = ‘DE’ AND name = ‘` && name && `’`.


DATA(cond) = `country = ‘DE’ AND name = ‘` &&

             cl_abap_dyn_prg=>escape_quotes( name ) && `’`.

to prevent a potential SQL Injection.

But how to find potential security risks?

Scanning and Analyzing programs


With Releases 7.0, EhP2, SP14, Release 7.3, EhP1, SP09 and Release 7.40, SP05 SAP plans to deliver a SAP NetWeaver Application Server, add-on for code vulnerability analysis that can be purchased as a separate product. This tool will be embedded in the well known Extended Program Check (SLIN) and herewith in the ABAP Test Cockpit (ATC) that also becomes available for customers.


These Security Tests carry out a static data flow analysis and will find such vulnerabilities as shown above.



The integration into ATC looks as follows:



Checks can be carried out during development and findings can be analyzed by the developer. Each message is accompanied by a long text with further information that points out how to fix a problem.


You can setup your system in such a way that transports cannot be realeased as long as security risks are found in programs to be transported.

Want to learn more?  Hope to see you at TechEd in workshop SIS261!

Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Former Member
      Former Member

      Ho Horst,

      Thanks for sharing. It is pretty interesting.

      6 years in ABAP, but honestly never thought on this perspective. I am not attending teched but would follow your blogs regarding this. Thanks again!



      Author's profile photo Former Member
      Former Member


      We are on 7.31 EHP6 SP5 yet we do not appear to have these new security checks in the ATC.  To what level must we be in order to have them?


      Author's profile photo Horst Keller
      Horst Keller
      Blog Post Author

      See SAP Note s 1865277 and 1855773.

      The security checks are available in the following Support Packages:

      • SAP_BASIS 702 Support Package 14
      • SAP_BASIS 731 Support Package 09
      • SAP_BASIS 740 Support Package 05
      Author's profile photo Former Member
      Former Member

      Just a minor remark: All information on the security checks is available in Note 1855773. The other note is no longer relevant.

      Author's profile photo Horst Keller
      Horst Keller
      Blog Post Author

      Thanx, is striked through  ...