Ensure AUTHORITY-CHECK Before Sensitive Operations
WarningSecurity & RobustnessQuickFix Ready#EC AUTH_CHECKRemote Enabled
Overview
Call Transaction Authority Check.
ATC Finding Message:
CALL TRANSACTION must be protected with AUTHORITY-CHECK
Rationale
Starting a transaction or sensitive operation without an authority check lets any user who reaches the code perform protected actions. Authorization must be verified before the operation, not assumed from the surrounding UI. Add WITH AUTHORITY-CHECK to the CALL TRANSACTION or perform an explicit AUTHORITY-CHECK first.
Non-Compliant
abap
CALL TRANSACTION 'ME21N'.Compliant
abap
CALL TRANSACTION 'ME21N' WITH AUTHORITY-CHECK.Automated QuickFix
This rule provides an automated QuickFix directly in Eclipse ABAP Development Tools (ADT):
- Position the cursor on the flagged statement.
- Press Ctrl + 1 (Quick Assist).
- Select the automated refactoring to apply the clean syntax immediately.
Suppression
To suppress findings for this rule, append the pseudo-comment to the statement:
abap
" Standard pseudo-comment:
... "#EC AUTH_CHECK
" SAP CI_ prefix format:
... "#EC CI_AUTH_CHECKTechnical Details
- Native ATC Class:
ZCL_SKYLINT_PREF_AUTH_CHECK - Implementation File: zcl_skylint_pref_auth_check.clas.abap