Securing SAP Systems from XSS vulnerabilities Part 2: Defense for SAP NetWeaver ABAP

Posted by Darya Maenkova on Jun 25

From the developer’s perspective

For all generic Web applications where you accept input parameters, you
must use encoding methods provided by the ICF handler. The
implementation of the encoding is available as an API in two variants:

•ABAP built-in function ESCAPE (available as of SAP_BASIS >= 731);

•Class implementation in CL_ABAP_DYN_PRG.

In releases higher or equal to SAP NetWeaver Release 7.0 enhancement
package 3…

Leave a Reply