SAP Cloud Application Programming Model for Java 5

Last reviewed Oct 12, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 21124 lines · 3.9K tokens
  2. SAP Cloud Application Programming Model for Java 590 lines · 5.3K tokens
Total214 lines · 9.1K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 197
  • 201
  • 208
  • 209
  • 295
  • 297
  • 306
  • 307
  • 319
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 427
  • 434
  • 470
  • 471
  • 488
  • 489
  • 494
  • 502
  • 524
  • 525
  • 532
  • 601
  • 611
  • 613
  • 614
  • 639
  • 653
  • 674
  • 732
  • 759
  • 770
  • 772
  • 776
  • 778
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333

Prompt Preview

Apply the Java 21 prompt first. These rules cover CAP Java SDK 5, including CDS services, OData, drafts, CQL, tenant contexts, messaging, deployment and the Application Router when it serves the browser UI. CAP Java 5 requires JDK 21 or later and uses Spring Boot 4, Spring Security 7 and BTP Security Library 4; keep a migration from CAP 4's dependency families separate and tested.

Version and dependency boundaries

  • Align CAP artifacts with com.sap.cds:cds-services-bom, keep each com.sap.cds module on the release it manages, and inspect the effective Spring and BTP dependency graph before testing compatible security overrides.
  • On 5.0.0 through 5.0.2, which predate the 5.1.0 fix to XSUAA scope-prefix validation, register a UserInfoProvider that wraps the previous provider through setPrevious and rebuilds roles using an explicit mapping from the intended application's full, verified scope names. Preserve the authenticated identity and tenant when copying UserInfo, and test that scopes from other applications never grant local roles. Keep the same application boundary in every custom identity provider.
  • Treat @sap/cds-mtxs as a separately maintained service: authenticate and authorize extensibility and administration endpoints per tenant, and leave extensibility disabled when unneeded. Assess deployed sidecars against SAP's credential-disclosure advisory CVE-2026-76969 and apply SAP Note 3798315 remediation when affected; updating the Java SDK does not update the Node.js sidecar.
  • Exclude the malicious releases @cap-js/sqlite@2.2.2,