SAP Knowledge Base Article - Public

3711408 - Forbidden statement is returned when trying to query System Tables

Symptom

When trying to perform a query in a system table following error is thrown "Malicious SQL query detected! " and an alert message appears informing that "The SQL query has forbidden statement for this type of action! ".

Environment

SAP SALES CLOUD CPQ

Reproducing the Issue

  1. Log into CPQ
  2. Open Script Workbench
  3. Run a Query in a system table, for example SqlHelper.GetFirst("SELECT TOP 1 name FROM sys.tables WHERE name = {Table Name})
  4.  Error is thrown "Malicious SQL query detected! " and an alert message appears informing that "The SQL query has forbidden statement for this type of action! ".

Cause

Expected Behavior.

Resolution

  1. From CPQ-2602 onward, System tables are treated as Sensitive data
  2. Access to the sys view (sys.tables, sys.column ...) is forbidden due to security reasons
  3. Implementation should be changed and Custom Tables should be used  instead of System Tables
  4. In case an extension is required, due to impact on implementation, CPQ Developers require:
    1. Detailed use case
    2. List of Tables in use
    3. Estimated time that is needed to migrate from System Tables to Custom Tables.

See Also

SAP Internal Table Information

Keywords

System Table, System View, Internal Table, sys view, Custom Table, Table, CPQ , KBA , CEC-SAL-CPQ , Sales Cloud CPQ , Bug Filed

Product

SAP CPQ 2024