Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
I want to write a simple source code audit tool, which can find errors. It is very important for me because I write master degree work. Please, help...
You need to define the objectives of the tool more clearly. When you say, you want to audit the source code what exactly do you intend to do. Define the functionalities of the tool and then we can give you some ideas as to how go about the same.
When you write a program in ABAP and do a syntax check / generate the program it parses the code.
I would suggest you to look at SE30, Code Inspector (SCI) to see what functionality is already existing so that you can accordingly design your tool. Most of the functions you are asking for already built in SAP.
If you still want to do it
1. You can scan the program code, and figure out what commands you want to give a error / warning for. For this you will have to decide upon a list of commands for which you wnat to throw a error.
You must also understand that I'm a student, which is looking not for complete comercial solution of other developers such as SCI. But I want to create graduate work at the university - simple auditing tool, which may be checks one or two errors only... I spent a lot of time in reseaching different inspection methodologies and want to apply one of them. Also I understood that source code auditing for ABAP very important because of language fields of usage.
P.S. if you have time, please answer: what kind of error may be checked automatically?
Even if the code inspector is a free and integral part of the ABAP workbench I believe you could write an interesting graduate work on this topic.
For example, you could analyze the various ABAP tools and feature to improve the quality of ABAP coding like
- code inspector (SCI)
- Coverage analyzer (SCOV)
- eCATT testing (SECATT)
- ABAP Unit Testing
- Checkpoint Groups & Assertions
However, you could also focus on possible shortcomings of the code inspector. For example, you write a report with as many coding errors (not syntax errors) as possible and see which of them are found by the code inspector and which not. A typical coding error would be a SELECT statment with option FOR ALL ENTRIES IN <itab> without checking if <itab> is not initial.
You could extend this work by finding out if and how the code inspector could be enhanced.
I need to define more exactly my question. I need to check any part of source code written on ABAP for <b>security threats</b>. From my investigations I find only one example of such threat - not explicit or absence of usages of authority_check in new developed modules. Please? give me more examples and I try to investigate the direction, which you show.
IF ( sy-uname = '<specific user name'> ).
* execute functions others users are not allowed to to
ENDIF.
CHECK ( sy-uname = '<specific user name'> ).
* execute functions others users are not allowed to to
(2) Are there hard-coded checks on sy-sysid, e.g.:
IF ( sy-sysid = '<specific SAP system ID'> ).
* execute functions not allowed on others SAP systems
ENDIF.
CHECK ( sy-sysid = '<specific SAP system ID'> ).
* execute functions not allowed on others SAP systems
While the threat in case (1) is obvious I would be suspicious if functions are linked to certain SAP systems. However, please note that a smart (evil) developer will easily circumvent checks on such security threats.
Bluesky
