SAP HANA Developer Guide - Get a Free Blog

Cross-site scripting (XSS)
● Problem
Cross-site scripting is a web-based vulnerability that involves an attacker injecting JavaScript into a link with
the intention of running the injected code on the target computer; the vulnerability comes in two types:
reflected (or non-persistent) and stored (or persistent). The "reflected" vulnerability affects individual users
in their local Web browser; the "stored" vulnerability is stored on a server and affects all users who visit the
served page.
● Solution
Since there are currently no libraries provided by the standard SAP HANA XS API to provide proper escaping,
the best solution for generating HTML on SAP HANA XS is to use the ESAPI JavaScript libraries as a start
point. In addition, we recommend not to write custom interfaces but to rely on well-tested technologies
supplied by SAP, for example, OData or JSON together with SAPUI5 libraries.
Broken authentication and session management
● Problem
Leaks or flaws in the authentication or session management functions allow attackers to impersonate users;
the attackers can be external as well as users with their own accounts to get privileges of those users.
● Solution
Use the built-in SAP HANA XS authentication mechanism and session management (cookies). For example,
use the "authentication" keyword to enable an authentication method and set it according to the
authentication method you want implement, for example: SAP logon ticket, form-based, or basic (user name
and password) in the application's .xsaccess file, which ensures that all objects in the application path are
available only to authenticated users.
Insecure direct object references
● Problem
An SAP HANA XS application is vulnerable to insecure direct object reference if the application lacks the
proper authentication mechanism for target objects.
● Solution
Make sure that only authenticated users are allowed to access a particular object. In the context of SAP HANA
XS, use the "authentication" keyword to enable an authentication method and set it according to the
authentication method you implement, for example: SAP logon ticket, form-based, or basic (user name and
password) in the application's .xsaccess file, which ensures that all objects in the application path are
available only to authenticated users.
SAP HANA Developer Guide
Writing Server-Side JavaScript Applications
P U B L I C
© 2012 SAP AG. All rights reserved. 215