Specifying working directory while executing FM SXPG_COMMAND_EXECUTE in SAP system

When executing FM SXPG_COMMAND_EXECUTE in SAP systems, you might need to specify a working directory for your external commands. A common approach is to create a script in SM69 transaction code that calls sh with parameters like -c 'cd <dir> && /path/to/command'.

However, this approach has limitations. The system doesn't accept wildcards, and the && operator gets converted to &, causing the script to fail.

SAP Note 401095 - Wildcards in External Commands

According to SAP Note 401095, wildcards are not supported in external commands for security reasons.

Symptom

Customers would like to use wildcards when defining external commands in SM49 and SM69 transactions.

Reason and Prerequisites

Wildcards are not supported in external commands primarily for security reasons. This restriction prevents potential security vulnerabilities through command injection.

Example Security Risk

Consider an ls command with a wildcard defined as "ls $1". During execution, if a malicious parameter "; rm -R /*" is entered, the operating system would execute the dangerous command string "ls; rm -R /*", potentially deleting all files.

# Dangerous command injection example
ls $1
# If $1 = "; rm -R /*"
# Becomes: ls; rm -R /*

Solution

The recommended solution is to call an external shell script where wildcards and directory changes are predefined. This approach maintains security while providing the flexibility needed for complex command execution.

Implementation Steps

Create a shell script that handles the working directory change and command execution ?

#!/bin/bash
# external_command.sh
cd /desired/working/directory
/path/to/your/command "$@"

Then configure this script in SM69 transaction as your external command, ensuring proper permissions and security measures are in place.

Conclusion

While direct wildcard usage and complex shell operations aren't supported in SAP external commands for security reasons, you can achieve the desired functionality by creating dedicated shell scripts that handle working directory changes and predefined wildcard operations safely.