Avoid Dynamic Metaprogramming and Code Generation (Remote Code Execution Risk)
WarningSecurity & Robustness#EC NO_METAPROGRAMMINGRemote Enabled
Overview
Metaprogramming and Dynamic Code Generation.
ATC Finding Message:
Avoid dynamic code generation and metaprogramming constructs
Rationale
Statements like GENERATE SUBROUTINE POOL, INSERT REPORT, and dynamic SYNTAX-CHECK create and execute uncompiled ABAP code at runtime. Metaprogramming introduces severe Remote Code Execution (RCE) vulnerabilities (CWE-94), defeats static analysis in ATC, and is completely blocked in ABAP Cloud and SAP BTP.
Cloud Standard: Use object-oriented polymorphism, strategy design patterns, or BAdIs instead of generating code dynamically.
Non-Compliant
abap
" Critical Security Vulnerability: Dynamic code execution from string buffer
GENERATE SUBROUTINE POOL lt_source_code NAME DATA(lv_prog).
PERFORM execute IN PROGRAM (lv_prog).Compliant
abap
" Clean ABAP Cloud: Object-oriented strategy pattern
DATA(lo_calculator) = zcl_calculator_factory=>get_strategy( iv_calc_type ).
DATA(lv_result) = lo_calculator->compute( it_data ).Suppression
To suppress findings for this rule, append the pseudo-comment to the statement:
abap
" Standard pseudo-comment:
... "#EC NO_METAPROGRAMMING
" SAP CI_ prefix format:
... "#EC CI_NO_METAPROGRAMMINGRelated Rules
- Handle System and Communication Failures in Remote Function Calls (RFC) —
#EC NO_RFC_ERR - Provide FAILED and REPORTED in RAP EML Statements (Silent Transaction Failure Prevention) —
#EC NO_UNHANDLED_EML - Avoid Unnecessary Dynamic Programming Constructs (SQL Injection Prevention) —
#EC NO_DYNAMIC_STMT
Technical Details
- Native ATC Class:
ZCL_SKYLINT_NO_METAPROGRAMMING - Implementation File: zcl_skylint_no_metaprogramming.clas.abap