The ABAP Code Scanner is a powerful tool designed to analyze ABAP (Advanced Business Application Programming) code for potential security vulnerabilities, code quality issues, and best practice violations. This provides a flexible and extensible way to scan ABAP code and generate comprehensive reports on various aspects of code security and quality.
- Multiple security checks including:
- Cross-Site Scripting (XSS) vulnerabilities
- Directory Traversal vulnerabilities
- Hardcoded credentials
- Weak cryptographic algorithms
- And many more...
- Customizable and extensible architecture
- Command-line interface for easy integration into CI/CD pipelines
- Detailed reporting in XLSX format
- Configurable scan settings
We are excited mdto announce that we are working on implementing a dataflow analysis feature. This enhancement will significantly improve the accuracy and depth of our security scans.
Dataflow analysis is a technique used to track how data moves through an application. In the context of security, it helps identify how potentially tainted data (e.g., user inputs) propagates through the system and whether it reaches sensitive sinks (e.g., database queries, output functions) without proper sanitization.
Our dataflow analysis will:
- Track parameters and their contents from the beginning of functions, reports, forms, includes, or other ABAP structures.
- Follow the data as it flows through the code, monitoring transformations and assignments.
- Identify potential injection points where tainted data might be used unsafely.
- Provide more accurate and context-aware vulnerability detection.
This feature will enable the to:
- Reduce false positives by understanding the context and transformations of data.
- Detect complex vulnerabilities that simple pattern matching might miss.
- Offer more detailed and actionable reports on potential security issues.
We are excited to announce that a more advanced version of the ABAP Code Scanner is available as private software. This enhanced version includes:
- Over 250 security checks for comprehensive code analysis
- Additional reporting formats and integration options
- Priority support and regular updates
For more information about the advanced private version, please contact RedRays, Inc. at [email protected].
- Python 3.9 or higher
- pip (Python package installer)
-
Clone the repository:
git clone https://github.com/redrays-io/ABAP-Code-Scanner.git cd ABAP-Code-Scanner -
Install the required dependencies:
pip install -r requirements.txt
To run the ABAP Code Scanner:
python main.py path/to/abap/code/dir
Optional arguments:
-c,--config: Path to the configuration file (default: config.yml)
When the program finishes successfully, you will find the abap_security_scan_report.xlsx file in the project folder.
Below, you can see an example of the report file.
The scanner can be configured using a YAML file. By default, it looks for config.yml in the project root. You can specify a different configuration file using the -c or --config option.
Example configuration:
checks:
- CheckCrossSiteScripting
- CheckSQLInjection
- CheckDirectoryTraversal
file_extensions:
- .abap
- .txt
exclude_patterns:
- "**/test/**"To add a new security check:
- Create a new Python file in the
checksdirectory. - Define a class that inherits from a base check class.
- Implement the required methods, including the main
runmethod. - Add the new check to the configuration file.
To run the test suite:
On Windows:
run_tests.bat
On Unix-like systems:
./run_tests.sh
Contributions to the ABAP Code Scanner are welcome! Please feel free to submit pull requests, create issues or spread the word.
This project is licensed under the MIT License - see the LICENSE file for details.
- Thanks to all contributors who have helped to improve this framework.
- Special thanks to the ABAP community for their invaluable resources and documentation.