SCI and ATC are very powerful code scanning tools (see blog and blog). Unfortunately you cannot apply it to standard SAP and add-ons.
Analyzing standard SAP code is the responsibility of SAP, and they take good and secure code (since they provide good code, it is weird they don’t allow everybody to scan their code…). Unfortunately a lot of add-on providers do not.
The blog will explain how to scan code of standard SAP and mainly on add-ons.
Questions that will be answered are:
- What is the background on not being able to scan standard SAP and add-on code?
- Can I truly scan the code of a new OSS note 7 days?
- How can I work around these restrictions and still scan the code of an add-on?
Background
The background of not being able to scan standard SAP code is explained in OSS note 1986391 – Using SLIN/SCI to check SAP standard objects. This note also explains you can scan OSS notes and transports for 7 days. After that time it is no longer possible. Unfortunately this rule also applies to add-ons.
Why run SCI on add-ons?
Why would you want to scan add-ons? Add-ons come with various quality levels. Ranging from very well written with much attention to performance and security. Some add-ons are full of performance issues and full of security leaks. Some are even allowing full dynamic read SELECT and UPDATE statement without any authorization check. This is heaven for a hacker!
The below method is meant for scanning these poor add-ons using the SCI tool for performance, robust coding and security.
ATC checks on non-SAP addons
First apply OSS note 2215288 – ABAP Test Cockpit: Analyzing Objects Using Arbitrary Prefix Namespaces.
For ATC checks, now run program SATC_AC_INIT_NAMESPACE_REG to add the namespace as registered for ATC.
See note 2439348 – SATC_AC_INIT_NAMESPACE_REG list is empty, if you get empty list.
See OSS notes: 2141202 – FAQ – ATC/CI: Analysing Objects with Custom Prefix Namespace ‘/MYSPACE/’ and 2313169 – ATC checks and ABAP Unit tests for objects in producer namespaces not possible
How to run SCI on SAP standard?
When you run the SCI tool on an add-on by selecting package or development object, you get the message that it does not contain any objects:
This is because your selection is first scanned for standard SAP and add-on objects. These are removed. So the result set is empty.
Goto transaction SE24 and select class CL_CI_OBJECTSET. Now select method BUILD_TADIRSET and display the code:
Put a break-point as statement if ENABLE_CI ne ‘X’.
Now start the SCI tool again. If the debugger stops at this statement, use debug and replace to change the content of ENABLE_CI to ‘X’. Now the skipping of SAP and add-on objects is not done. SCI will scan the code. It will still not use SLIN. But these are minor checks.
Bug fix OSS notes
Bug fix notes: