Quantcast
Channel: SCN: Message List - Security
Viewing all articles
Browse latest Browse all 5338

Re: Is the Goto Statement in Debugging a security risk?

$
0
0

It is often misunderstood as forward and backward navigation instead of stepping in the debugger and always checked actvt 02 - but in earlier releases was not as obvious to find and did not write a system log message. You can now also right-click the location to GOTO.

 

But it is just as dangerous if not more so that changing a variable in the debugger and more than just display. Reason is that between the current code line and the code line "jumped to", the code in between is not executed at all...

 

So you can jump over authority-checks instead of having to change the sy-subrc result. Changes can be made without the calls to change documents and logs being made. All other forms of validations or checks can be jumped over, including statements which were created not to be able to debug them (such as kernel calls) then you don't need to be able to change anything in the debugger if you can steer wide of it.

 

It is functionally equivalent to being able to create a program and execute it, regardless of your other authorizations, developer key or even if the system is closed for changes.

 

So... very naughty. Only for developers in development systems and even in emergency situations it should not really be used in production either.

 

Cheers,

Julius


Viewing all articles
Browse latest Browse all 5338

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>