Avoid DUMMY Authorization Checks

ErrorSecurity & Robustness#EC NO_DUMMY_AUTHRemote Enabled

Overview

Avoid AUTHORITY-CHECK with the DUMMY addition.

ATC Finding Message: AUTHORITY-CHECK DUMMY never checks the field; supply FIELD and evaluate sy-subrc

Rationale

The DUMMY addition turns AUTHORITY-CHECK into a no-op: the runtime accepts the statement without evaluating the authorization object, so the protected operation runs for every user. Such dummy checks are frequently added to satisfy scanners or to unblock a test and then remain in production. Remove the DUMMY addition and evaluate sy-subrc so the authorization is genuinely enforced.

Non-Compliant

AUTHORITY-CHECK OBJECT 'Z_FI_BUKRS'
  ID 'BUKRS' DUMMY.

Compliant

AUTHORITY-CHECK OBJECT 'Z_FI_BUKRS'
  ID 'BUKRS' FIELD lv_bukrs.
IF sy-subrc <> 0.
  RAISE EXCEPTION NEW zcx_no_authorization( ).
ENDIF.

Suppression

To suppress findings for this rule, append the pseudo-comment to the statement:

" Standard pseudo-comment:
... "#EC NO_DUMMY_AUTH

" SAP CI_ prefix format:
... "#EC CI_NO_DUMMY_AUTH

Related Rules

• Check sy-subrc Promptly After AUTHORITY-CHECK (CWE-862 Authorization Bypass) — #EC PREF_AUTH_SUBRC
• Ensure AUTHORITY-CHECK Precedes Sensitive Business Operations — #EC PREF_AUTH_CHECK
• Avoid Unnecessary Dynamic Programming Constructs (SQL Injection Prevention) — #EC NO_DYNAMIC_STMT

Technical Details

• Native ATC Class: ZCL_SKYLINT_NO_DUMMY_AUTH
• Implementation File: zcl_skylint_no_dummy_auth.clas.abap