How GrundScan verifies BSI APP.4.6

Detects executable reports (REPORT programs) that lack an AUTHORITY-CHECK statement, leaving them accessible to any user.

Verifies that SY-SUBRC is evaluated immediately after every AUTHORITY-CHECK call. An unchecked return code means the authorization result is silently ignored.

Checks that CALL TRANSACTION statements are preceded by an AUTHORITY-CHECK. Without it, any user can launch arbitrary transactions from within the add-on.

Flags homegrown permission logic (custom tables, hardcoded user lists) used in place of SAP's standard AUTHORITY-CHECK mechanism.

Confirms the presence of development guideline artefacts in the codebase (e.g. policy include programs). This is a structural/organisational check rather than a code pattern check.

Looks for early RETURN, EXIT, or CHECK statements that could short-circuit authorization logic before it completes.

Scans RFC-enabled function modules and BAPIs for missing input validation and absent authorization checks on sensitive parameters.

Detects OPEN DATASET statements that read or write files without a preceding AUTHORITY-CHECK on the S_DATASET object.

Identifies function modules with REMOTE-ENABLED or RFC=YES attributes that contain no AUTHORITY-CHECK, making them callable over RFC by any authenticated user.

Flags calls to SXPG_COMMAND_EXECUTE and similar OS-command function modules where the command string is not validated against the SM69 command table.

Detects GENERATE SUBROUTINE POOL and INSERT REPORT — statements that create executable ABAP programs at runtime, a common malicious code injection vector.

Flags dynamic CALL FUNCTION or CALL METHOD where the function/method name is a variable, which can be exploited to invoke arbitrary functionality.

Detects SELECT statements with a dynamic FROM clause (variable table name), which can expose any database table to unauthorised reads.

Flags EXEC SQL blocks. Native SQL bypasses SAP's client isolation, authorization layer, and buffering — and is a common SQL injection vector.

Scans for sensitive field names (passwords, keys, credentials) written to application logs, MESSAGE statements, or WRITE outputs.

Detects conditional logic branching on SY-SYSID or SY-MANDT that disables security checks in specific systems (e.g. 'IF sy-sysid = DEV THEN skip auth').

Flags hardcoded SAP client numbers used to gate functionality, which creates a backdoor in specific client configurations.

Detects dynamic WHERE clauses, dynamic ORDER BY, and dynamic field lists built from unvalidated user input — the ABAP equivalent of SQL injection.

Scans BSP pages and ICF handlers for user-controlled values written directly to HTML output without escaping via CL_ABAP_HMAC or similar.

Flags SELECT … CLIENT SPECIFIED and writes to cross-client tables (those without a MANDT key field), which break SAP's tenant isolation model.

Detects patterns that generate or execute ABAP source code that is not visible in standard repository tools — obfuscated or runtime-only logic.

Confirms that automated code analysis has been applied to the codebase. Running a GrundScan analysis satisfies this requirement by definition.