SAP encoding functions in the Web environment, SAP security note 866020

SAP security note 866020, "SAP encoding functions in the Web environment", was released on 29.06.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

User input using a Web front end, or input from user inputs and log files, is displayed directly, allowing the potential execution of unintended external source code (e.g., JavaScript) in an application.

Solution

SAP has developed several encoding methods that comply with OWASP XSS Prevention standards:

• ABAP (SAP Note 1582870): The class CL_ABAP_DYN_PRG contains XSS encoding methods. Refer to SAP Note 1487337 for additional details.
• C/C++ (SAP Note 1582867): These functions are available exclusively within SAP. Create a customer message for BC-SEC.
• Java (SAP Note 1590008): Utilize the security class in the J2EE and JEE libraries (tc_sec_csi.jar). These functions are available as per the releases specified in SAP Notes 1582868, 1582870, and 1590008.

Reason and prerequisites

To prevent the unintentional execution of external source code, any external user input or content from external sources must be encoded appropriately before being displayed in a web browser.

CVSS

Score 0

References

• Security Note 1601461 – Update #1 to Security Note 866020
• JAVA output encoding (SAP Note 1590008)
• ABAP XSS Escaping Support (SAP Note 1582870)
• Security options (XSS) for ESCAPE (SAP Note 1582867)
• Improved performance of encoding functions in Web environment (SAP Note 985459)
• ITS: new functions for XSS prevention (SAP Note 903820)

Affected components

• SAP_BASIS 620 to 731