Avoid Unnecessary Dynamic Programming Constructs (SQL Injection Prevention)
Overview
No Dynamic Constructs (CALL, ASSIGN, CREATE, etc.).
ATC Finding Message:
Avoid dynamic calls and language constructs
Rationale
Dynamic ABAP statements (like dynamic SQL SELECT (lt_fields) FROM (lv_table) WHERE (lv_cond), dynamic method calls CALL METHOD (lv_class)=>(lv_meth), or dynamic assignments ASSIGN (lv_var) TO <fs>) bypass compile-time syntax checks, cannot be analyzed by static ATC security tools, and introduce severe SQL Injection (CWE-89) risks.
Security Standard: Write static, strongly-typed OpenSQL and OOP code wherever possible. When dynamic SQL is unavoidable (e.g. in generic analytics engines), escape input variables thoroughly using cl_abap_dyn_prg.
Non-Compliant
" Critical Security Vulnerability: SQL Injection via unsanitized WHERE string
DATA(lv_where) = |CUSTOMER_ID = '{ iv_user_input }'|.
SELECT * FROM zcustomers WHERE (lv_where) INTO TABLE @DATA(lt_cust).Compliant
" Secure: Static typed OpenSQL with host variable binding
SELECT customer_id, customer_name
FROM zcustomers
WHERE customer_id = @iv_user_input
INTO TABLE @DATA(lt_cust).Configuration & Thresholds
This check can be fine-tuned directly in the ATC Check Variant Editor (CHKV) in Eclipse ADT:
| Parameter Name | Data Type | Default Value | Description & Guidance |
|---|---|---|---|
CHECK_DYNAMIC_SQL | Boolean | true | Detect dynamic table names, column projections, and WHERE clauses in OpenSQL |
IGNORE_RAP_QUERY_PROVIDER | Boolean | true | Allow dynamic queries inside custom RAP query provider implementations (IF_RAP_QUERY_PROVIDER) |
Suppression
To suppress findings for this rule, append the pseudo-comment to the statement:
" Standard pseudo-comment:
... "#EC NO_DYNAMIC_STMT
" SAP CI_ prefix format:
... "#EC CI_NO_DYNAMIC_STMTRelated Rules
- Provide FAILED and REPORTED in RAP EML Statements (Silent Transaction Failure Prevention) —
#EC NO_UNHANDLED_EML - Avoid Dynamic Metaprogramming and Code Generation (Remote Code Execution Risk) —
#EC NO_METAPROGRAMMING - Avoid Kernel and Native Database Calls (SYSTEM-CALL, EXEC SQL) —
#EC NO_KERNEL_CALL
Technical Details
- Native ATC Class:
ZCL_SKYLINT_NO_DYNAMIC_STMT - Implementation File: zcl_skylint_no_dynamic_stmt.clas.abap