Avoid Hardcoded HTTP, HTTPS, and FTP URLs in Source Code
Overview
Avoid hardcoded HTTP, HTTPS, and FTP URLs in source code.
ATC Finding Message:
Avoid hardcoded URL; use SM59 destination or communication arrangement
Rationale
Hardcoding absolute URLs and endpoint addresses directly in source code creates brittle dependencies, environment pollution, and security vulnerabilities. When promoting code across landscapes (DEV -> QA -> PROD) or deploying to ABAP Cloud environments, hardcoded URLs prevent environment-specific endpoint resolution and break proxy routing.
Best Practice: Maintain remote endpoints in SM59 RFC destinations, Communication Arrangements, or Customizing tables, and resolve them dynamically at runtime.
Non-Compliant
" Anti-pattern: Hardcoded URL connection
DATA(lo_dest) = cl_http_destination_provider=>create_by_url(
i_url = 'https://api.skylint.org/v1/orders' ).
DATA(lo_client) = cl_web_http_client_manager=>create_by_http_destination( lo_dest ).Compliant
" Clean ABAP: Configuration-based destination (SM59, BTP, or Communication Arrangement)
DATA(lo_dest) = cl_http_destination_provider=>create_by_destination(
i_destination = 'SKYLINT' ).
DATA(lo_client) = cl_web_http_client_manager=>create_by_http_destination( lo_dest ).Configuration & Thresholds
This check can be fine-tuned directly in the ATC Check Variant Editor (CHKV) in Eclipse ADT:
| Parameter Name | Data Type | Default Value | Description & Guidance |
|---|---|---|---|
CHECK_HTTP | Boolean | true | Flag hardcoded HTTP and HTTPS URLs |
CHECK_FTP | Boolean | true | Flag hardcoded FTP and SFTP URLs |
Suppression
To suppress findings for this rule, append the pseudo-comment to the statement:
" Standard pseudo-comment:
... "#EC NO_HARDCODED_URL
" SAP CI_ prefix format:
... "#EC CI_NO_HARDCODED_URLRelated Rules
- Avoid Hardcoding System & Tenant Environment Checks (sy-sysid, sy-mandt) —
#EC NO_HARDCODED_ENV - Handle System and Communication Failures in Remote Function Calls (RFC) —
#EC NO_RFC_ERR
Technical Details
- Native ATC Class:
ZCL_SKYLINT_NO_HARDCODED_URL - Implementation File: zcl_skylint_no_hardcoded_url.clas.abap