Anchor links are generated with unwanted HTTP href address, SAP security note 1294431

SAP security note 1294431, "Anchor links are generated with unwanted HTTP href address", is a program error note released on December 2, 2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

When working in SAP CRM, fully-qualified URLs of object links can be visible and copied by users. In certain scenarios, these URLs may contain session information. Improper system configuration can allow other users with the copied URLs to access the sender’s session. This poses a security risk as session URLs can be exploited.

The root cause is that HTML anchor tags are generated with href=’#’. Browsers interpret this # as a relative reference within the page, replacing it with the full page address. Consequently, the full address becomes visible and can be copied by users. While there are more appropriate security measures to prevent session reuse, this note addresses the issue by preventing end-users from seeing fully qualified URLs unnecessarily. The recommended approach is to use href="javascript:void(0);" for anchor elements to avoid exposing HTTP information.

Solution

Implement the following enhancement:

• Modify HTML anchor tags to use href="javascript:void(0);" instead of href=’#’ to prevent the exposure of full URLs.
• Apply Note 1136402, which implements similar fixes for InputField and Checkbox tags.

References

• 1136402 – CRM Framework: UI related issues
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• CRMUIF: 510, 520, 600
• WEBCUIF: 700, 730