SAP security note 1502272, "Function module for escaping quotes". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
New function modules are provided with this note. The new function modules are:
RS_ESCAPE_QUOTESRS_CHECK_VARIABLERS_CHECK_WHITELIST_TAB
Implementing the function modules is required only if another note specifies this note as a prerequisite.
Solution
You can implement the new function modules via Support Package or via the Note Assistant. This note contains three correction instructions:
- For Releases 31I, 40B, and 45B
- For Releases 46B and 46C
- For SAP_BASIS Releases 620, 640, 700, 701, 702, 710, 711, 720, and 730
Reason and prerequisites
The new function modules are used as the basis for various quality improvement measures in the dynamic programming area. This includes the composition of dynamic WHERE clauses, dynamic SET clauses, and program texts that should be created with INSERT REPORT or GENERATE SUBROUTINE-POOL.
The functions of the function modules RS_ESCAPE_QUOTES, RS_CHECK_VARIABLE, and RS_CHECK_WHITELIST_TAB will be provided in later releases by the class CL_ABAP_DYN_PRG. As of SAP_BASIS Release 700, you must use the class CL_ABAP_DYN_PRG. For compatibility reasons, however, the function modules are also provided in Release SAP_BASIS 700 and higher.
CVSS
Score 0
References
This note refers to
Affected components
- SAP_APPL: Release 31I until SAPKH31IB9; Release 40B until SAPKH40B89; Release 45B until SAPKH45B67
- SAP_BASIS: Release 46B to 46C; Release 620 to 640; Release 700 to 702; Release 710 to 730
Full note on SAP: SAP Support Launchpad note 1502272
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].