Data Validation from External Web service

[Shyam_k]

Hi All,

We have a requirement wherein we pass some input parameters to an external web service from HANA (via XSJS Jobs) and then receive datasets post processing.

Now the client security team raised the concern of major vulnerabilities in (web) applications, such as cross site scripting, SQL injection, interpreter injection, locale/Unicode attacks, file system attacks, and buffer overflows.

The overall architecture of this process is illustrated below:

Now the question is, does HANA have any inbuilt validation mechanism to achieve this or is writing manual validation code the only option?

Let me know if you have any experience in this regard.

Thanks,

Shyam

[thomas_jung · Accepted solution]

>does HANA have any inbuilt validation mechanism to achieve this

Your going to have to be more specific what you mean by "achieve this". You listed many different security aspects and there is no one answer to that. For instance SQL injection is largely protected against by using prepared statements.  Still this doesn't remove the responsibility to also do good input validation checks. CORS and XSRF checks are largely built into the underlying framework and can be configured via XSADMIN/XSACCESS.

I would suggest reviewing at least this section of the HANA Developers' Guide:

Server-Side JavaScript Security Considerations - SAP HANA Developer Guide for SAP HANA Studio - SAP ...

[Shyam_k · Accepted solution]

Hi Thomas,

Please excuse my ignorance on this subject as these security mechanisms aren't something I fully comprehend at this point. Your links have provided a good starting point for me to go on.

Thanks fo the help.

Cheers,

Shyam

[Shyam_k · Accepted solution]

Hi Thomas,

Can you please have a look at my question at:

I need a small confirmation on this topic.

Thanks,

Shyam