Avoid Dangerous & Dynamic Native Statements

WarningSecurity & Robustness#EC DANGEROUS_STMTRemote Enabled

Overview

Dangerous Statements (abaplint dangerous_statement).

ATC Finding Messages:

• Dangerous statement detected; avoid dynamic/unmanaged language construct
• Avoid RAISE SHORTDUMP; prefer graceful class-based exceptions
• Avoid native ASSERT in production logic; raise an exception instead

Rationale

Dynamic report generation, kernel calls, native SQL, and production ASSERT or RAISE SHORTDUMP bypass the ABAP runtime and its security model. They are not available in ABAP Cloud and can introduce injection risks or portability problems. Use supported ABAP SQL and class-based APIs instead.

Non-Compliant

EXEC SQL.
  SELECT * FROM /dmo/customer INTO :wa.
ENDEXEC.

Compliant

SELECT customer_id FROM /dmo/customer INTO TABLE @lt_customer_ids.

Configuration & Thresholds

This check can be fine-tuned directly in the ATC Check Variant Editor (CHKV) in Eclipse ADT:

Parameter Name	Data Type	Default Value
CHECK_EXEC_SQL	Boolean	true
CHECK_KERNEL_CALL	Boolean	true
CHECK_SYSTEM_CALL	Boolean	true
CHECK_SYNTAX_CHECK	Boolean	true
CHECK_INSERT_REPORT	Boolean	true
CHECK_GENERATE_DYNPRO	Boolean	true
CHECK_GENERATE_REPORT	Boolean	true
CHECK_GENERATE_SUBROUTINE	Boolean	true
CHECK_DELETE_REPORT	Boolean	true
CHECK_DELETE_TEXTPOOL	Boolean	true
CHECK_INSERT_TEXTPOOL	Boolean	true
CHECK_DELETE_DYNPRO	Boolean	true
CHECK_EXPORT_DYNPRO	Boolean	true
CHECK_EDITOR_CALL	Boolean	true
CHECK_DYNAMIC_SQL	Boolean	true
CHECK_RAISE_SHORTDUMP	Boolean	true
CHECK_PROD_ASSERT	Boolean	true
IGNORE_RAP_QUERY_PROVIDER	Boolean	true

Suppression

To suppress findings for this rule, append the pseudo-comment to the statement:

" Standard pseudo-comment:
... "#EC DANGEROUS_STMT

" SAP CI_ prefix format:
... "#EC CI_DANGEROUS_STMT

Technical Details

• Native ATC Class: ZCL_SKYLINT_NO_DANGEROUS_STMT
• Implementation File: zcl_skylint_no_dangerous_stmt.clas.abap