SAP HANA Developer Guide - Get a Free Blog

Make sure you have addressed the issues described in "Broken Authentication and Session Management"
and "Insecure Direct Object References". In addition, check if a user is allowed to access a specific URL before
actually executing the code behind that requested URL. Consider putting an authentication check in place for
each JavaScript file before continuing to send any data back to the client's Web browser.
Insufficient transport layer protection
● Problem
Without transport-layer protection, the user's network traffic can be monitored, and attackers can steal
sensitive information such as logon credentials or credit-card data.
● Solution
Turn on transport-layer protection in SAP HANA XS; the procedure is described in the SAP HANA security
guide.
Invalidated redirects and forwards
● Problem
Web applications frequently redirect users to other pages or use internal forwards in a similar manner.
Sometimes the target page is specified in an invalid (not permitted) parameter. This enables an attacker to
choose a destination page leading to the possibility of phishing attacks or the spamming of search engines.
● Solution
To prevent invalidated redirects or forwards, application developers should validate the requested destination
before forwarding, for example, by checking if the destination is present in a whitelist.
XML processing issues
● Problem
There are several potential security issues related to processing XML as input or to generating XML as output.
In addition, problems with related technologies (such as XSLT) can enable the inclusion of other (unwanted)
files.
● Solution
Bear the following rules and suggestions in mind when processing or generating XML output:
○ When processing XML coming form an untrusted source, disable DTD processing and entity expansion
unless strictly required. This helps prevent Billion Laugh Attacks (Cross-Site Request Forgery), which can
bring down the processing code and, depending on the configuration of the machine, an entire server.
○ To prevent the inclusion (insertion) of unwanted and unauthorized files, restrict the ability to open files or
URLs even in requests included in XML input that comes from a trusted source. In this way, you prevent
the disclosure of internal file paths and internal machines.
SAP HANA Developer Guide
Writing Server-Side JavaScript Applications
P U B L I C
© 2012 SAP AG. All rights reserved. 217