Avoid Native ASSERT in Production Code (Prevent Unrecoverable Dumps)

WarningSecurity & Robustness#EC NO_PROD_ASSERTRemote Enabled

Overview

Native ASSERT in Production Logic.

ATC Finding Message: Avoid native ASSERT in production logic; raise an exception instead

Rationale

The ABAP statement ASSERT condition immediately raises an uncatchable short dump (ASSERTION_FAILED) if the condition evaluates to false. While useful in unit test classes, using unconditioned assertions in production application logic abruptly terminates end-user sessions, loses uncommitted data, and creates emergency incidents.

Best Practice: Check conditions gracefully and raise recoverable class-based exceptions with informative error messages. Reserve ASSERT strictly for ABAP Unit test includes (LCL_TEST).

Non-Compliant

" Dangerous: Causes catastrophic user session crash in production
ASSERT iv_amount > 0.

Compliant

" Clean ABAP: Graceful validation with recoverable domain exception
IF iv_amount <= 0.
  RAISE EXCEPTION NEW zcx_invalid_amount( iv_amount ).
ENDIF.

Suppression

To suppress findings for this rule, append the pseudo-comment to the statement:

" Standard pseudo-comment:
... "#EC NO_PROD_ASSERT

" SAP CI_ prefix format:
... "#EC CI_NO_PROD_ASSERT

Related Rules

• Avoid Kernel and Native Database Calls (SYSTEM-CALL, EXEC SQL) — #EC NO_KERNEL_CALL
• Ensure AUTHORITY-CHECK Precedes Sensitive Business Operations — #EC PREF_AUTH_CHECK
• Check sy-subrc Promptly After AUTHORITY-CHECK (CWE-862 Authorization Bypass) — #EC PREF_AUTH_SUBRC

Technical Details

• Native ATC Class: ZCL_SKYLINT_NO_PROD_ASSERT
• Implementation File: zcl_skylint_no_prod_assert.clas.abap