Avoid Hardcoded and Unescaped Raw HTML in Source Code
Overview
Avoid raw unescaped HTML tags in strings and templates.
ATC Finding Message:
Avoid hardcoded raw HTML; use UI5, BSP, or cl_abap_format/escape to prevent XSS
Rationale
Embedding raw HTML markup strings (<div>, <script>, <table>) directly in ABAP source code creates Cross-Site Scripting (XSS) vulnerabilities (OWASP A03 / CWE-79) and couples backend logic to user interface rendering. When dynamic values are concatenated into raw HTML without strict escaping, malicious scripts can be executed in the user's browser session.
Best Practice: Separate presentation from logic using SAP Fiori / SAPUI5, BSP extensions, or use cl_abap_format / escape( ... format = cl_abap_format=>e_html_text ) to sanitize HTML output.
Non-Compliant
" Anti-pattern: Concatenating unescaped user data into raw HTML
DATA(lv_html) = |<div class="user-info"><b>{ lv_name }</b></div>|.Compliant
" Clean ABAP: Use UI framework or encode output to prevent XSS
DATA(lv_safe_name) = escape( val = lv_name format = cl_abap_format=>e_html_text ).
DATA(lv_html) = |<div class="user-info"><b>{ lv_safe_name }</b></div>|. "#EC NO_RAW_HTMLConfiguration & Thresholds
This check can be fine-tuned directly in the ATC Check Variant Editor (CHKV) in Eclipse ADT:
| Parameter Name | Data Type | Default Value | Description & Guidance |
|---|---|---|---|
CHECK_SCRIPTS | Boolean | true | Detect high-risk script and iframe HTML tags |
CHECK_TAGS | Boolean | true | Detect structural HTML tags (div, table, form, etc.) |
Suppression
To suppress findings for this rule, append the pseudo-comment to the statement:
" Standard pseudo-comment:
... "#EC NO_RAW_HTML
" SAP CI_ prefix format:
... "#EC CI_NO_RAW_HTMLRelated Rules
- Avoid Hardcoded HTTP, HTTPS, and FTP URLs in Source Code —
#EC NO_HARDCODED_URL - Avoid Hardcoded IPv4 and IPv6 Addresses in Source Code —
#EC NO_HARDCODED_IP
Technical Details
- Native ATC Class:
ZCL_SKYLINT_NO_RAW_HTML - Implementation File: zcl_skylint_no_raw_html.clas.abap