Skip to content

Application tech debt register

This page consolidates all CRITICAL and HIGH severity tech debt findings from all LegalMaintenance library analyses. No CRITICAL-severity findings were identified; all findings below are HIGH severity.

Critical findings

No CRITICAL-severity findings were identified in the analyzed libraries.

High findings

Library Finding Impact Recommended action
LegalMaintenance NTLM/Windows-integrated authentication with no <authorization> element in Web.config, so ASP.NET defaults to <allow users="*"/>; all URL-level access control is delegated to IIS configuration outside the application. Access control depends entirely on infrastructure configuration that cannot be verified from code, risking silent over-permissive access. Add an explicit <authorization> section (or equivalent role checks) in the application and confirm IIS-level ACLs are actually restrictive.
LegalMaintenance frmAttorneyProfile's whole-page IsViewOnly lockdown is dead code: SecurityRole remains NoAccess for the page lifetime, so IsViewOnly always evaluates False and intended read-only enforcement never executes. View-only users can perform edits the UI intends to block. Fix the SecurityRole assignment/initialization so IsViewOnly reflects actual AD group membership, and add a regression test for the view-only path.
LegalMaintenance DataHelper.aspx is an ungated AJAX mutation endpoint: it bypasses the shared page ancestor, performs no authorization check, accepts a client-supplied ViewID, and wraps the call to clsAttorneyTableManager.ProcessAjaxRequest in an empty catch that silently swallows errors. A user in the view-only (LNView) group can mutate data through this path, and errors are hidden from the caller. Add explicit authorization checks before dispatching the AJAX request, validate/allow-list ViewID, and replace the empty catch with logged error handling.
LegalMaintenance <pages enableEventValidation="false"> disables ASP.NET's postback integrity checks, allowing a client to re-enable a disabled toolbar button and post back actions that should be blocked. Client-side UI state (e.g., disabled buttons in view-only mode) can be bypassed via crafted postbacks. Re-enable event validation (or apply page-specific overrides only where strictly required) and add server-side re-validation of button state on postback.
LegalMaintenance frmHearingLocation.aspx has an inverted empty-collection guard combined with a fallback manager type-cast bug, and frmRotation.aspx has a similar fallback manager type mismatch hidden by a try/catch. Both can cause the wrong manager instance to be used silently, producing incorrect behavior without a visible error. Correct the guard logic/type casts and remove the swallowing try/catch so mismatches surface as actionable errors.
LegalMaintenance LNView's semantics are inverted relative to its name: IsInViewOnly returns True when the principal is in the LNView AD group (triggering read-only mode), while users in no legal group at all get a fully enabled toolbar. The permission model may not match its intended design, risking incorrect access grants; unconfirmed by any domain SME. Confirm intended semantics with a domain SME, rename the group/check or invert the logic to match intent, and add explicit tests for both membership states.
SAIF.Business.View.Provider clsProviderCollection builds SQL via unparameterized string concatenation in two places: a tax-ID IN list and a caller-supplied WHERE clause appended verbatim with no bind variables. SQL-injection risk if any caller-controlled value reaches these paths. Replace string concatenation with parameterized/bound queries; constrain caller-supplied WHERE clauses to a validated predicate builder.
SAIF.Business.Tasks Task search SQL is built via unsafe string interpolation (FormatOtherParameters/FormatContextParameters), embedding user-supplied text with no bind variables/escaping, and formatting CONTEXT_DATE as a locale-dependent literal instead of TO_DATE(...). SQL-injection risk and locale-dependent date parsing failures. Parameterize all task-search predicates with bind variables and use explicit TO_DATE/format-mask handling for date literals.
SAIF.Business.Tasks TaskPriority.Urgent emits a malformed SQL fragment appended after an already-open IN ( clause, producing an unbalanced/invalid predicate. Task searches filtered by the Urgent priority may fail or behave incorrectly. Fix the fragment builder to close the IN (...) clause correctly before appending additional predicates, and add a unit test asserting well-formed SQL.
SAIF.Business.Claim.Legal Attorney assignment/calendar-sync side effects (real e-mail, real Exchange calendar writes) are gated by an environment check driving a testing flag; if the environment is misclassified, non-production environments can perform real-world side effects. Non-production testing could trigger real e-mail/calendar actions affecting real attorneys/schedules. Add defensive environment verification (e.g., fail-safe default to test mode, explicit environment allow-list) and alerting if the environment check itself fails.
SAIF.Application ServiceResponse.ProcessException contains an infinite-loop bug: it reassigns LocalEX = ex.InnerException on every iteration instead of LocalEX.InnerException, so a loop intended to walk the inner-exception chain never advances past the first inner exception. Exception chain traversal fails for 2+ levels of nesting, and can loop indefinitely if implemented as a while construct. Fix the reassignment to LocalEX = LocalEX.InnerException and add a null-terminating loop condition with a maximum iteration guard.
SAIF.Services.Appworx submit_appworx_job stored-procedure invocation swallows a NO_DATA_FOUND condition rather than surfacing it to the caller. Failed/no-op batch job submissions may appear to succeed, hiding operational failures. Propagate NO_DATA_FOUND (and other proc-level failures) as an explicit result/exception so callers can detect and retry failed submissions.

Summary

Severity Count
CRITICAL 0
HIGH 11
Total 11

Sources