Tech debt¶
This register lists six high-severity items and a set of lower-severity items found in the ClaimBillEntry application, including one item inherited from the consumed SAIF.Services assembly. No item is rated critical.
Summary¶
| Severity | Count |
|---|---|
| Critical | 0 |
| High | 6 |
| Lower severity (additional items) | 21 |
| Total | 27 |
High severity¶
TD-001 NTLM authentication dependency¶
The application relies on IIS Windows authentication, which negotiates NTLM or Kerberos, with anonymous access disabled (Pipelines/build-vars.yml:20-27). NTLM is a legacy protocol with known relay and credential-exposure weaknesses. Remediation: move to OpenID Connect or OAuth 2.0 with a modern identity provider.
TD-002 No anti-forgery protection and data deletion through GET¶
POST actions such as Entry/SaveBill, Entry/SubmitBill, Entry/SendPendBill and Entry/DiscardBill have no anti-forgery validation (ClaimBillEntry/Controllers/EntryController.cs:108-167). DiagnosisGrid/ClearDiagnosesCodes and ProcedureGrid/ClearProcedureCodes delete data through GET requests (ClaimBillEntry/Controllers/DiagnosisGridController.cs:108, ClaimBillEntry/Controllers/ProcedureGridController.cs:104). See Hosted endpoints. Remediation: add anti-forgery tokens and change deletions to POST.
TD-003 Authorization enforced on the client or missing¶
The CBEDiscardBill permission only hides the Discard button; Entry/DiscardBill does not check it (BR-SCR-006, ClaimBillEntry/Controllers/EntryController.cs:159-167,209). The grid, provider and lookup controllers carry no SaifAuthorize role check, so any authenticated Windows user can call them. Remediation: check the permission in the action and apply role attributes to every controller.
TD-004 Insecure base Web.config settings¶
customErrors is Off, compilation debug is true, Glimpse is on in the base file, validateRequest is false and requestValidationMode is 2.0 (ClaimBillEntry/Web.config:30-32, :381-385, ClaimBillEntry/Views/Web.config:29). The Release transform removes debug and turns Glimpse off only for release builds. See Configuration. Remediation: make secure values the base defaults.
TD-005 Unencoded HTML in service preview¶
BuildServicePreviewHtml builds HTML without encoding and the PreviewHtmlString property allows HTML (ClaimBillEntry/Controllers/ServiceGridController.cs:159-228, ClaimBillEntry/ViewModels/Entry/ServiceViewModel.cs:49). Combined with disabled request validation this is a cross-site scripting risk. Remediation: encode every value placed in the HTML.
TD-006 Outdated platform¶
The application targets .NET Framework 4.6.x, jQuery 1.9.1 and Kendo UI 2018.2.620 (ClaimBillEntry/ClaimBillEntry.csproj:16, :114-115, ClaimBillEntry/packages.config:17). These versions are out of vendor support. Remediation: plan upgrades of the framework and client libraries. See Dependencies.
Additional items¶
| Item | Detail | Source |
|---|---|---|
Unfiltered bill search results (inherited from SAIF.Services) |
SearchController's search action calls IBillQueryService.GetBillEntryBillsByCriteria(BillEntrySearchCriteria) in the consumed SAIF.SAIFCode.Core package (SAIF.Services assembly). The package's own security-authorization findings record this method as returning unfiltered bills (SEC-01)† — it applies neither the local conflict-claim check that EntryController.GetBill performs (UserHasAccessToClaim → IsConflictClaim + IsAuthorized("ConflictClaim")) nor the package-computed HasConflictAccess flag that BaseController.CheckSecurity† separately consumes (SVC-BR-SEC-01). This is an inherited risk surfaced through ClaimBillEntry's Search screen, not a defect introduced by ClaimBillEntry code. Cross-reference: SVC-BR-SEC-01 (the ClaimSecurityService pattern that GetBillEntryBillsByCriteria apparently does not apply), BR-SCR-013 (search requires qualifying criteria — a distinct, already-documented screen rule that does not address this filtering gap) |
ClaimBillEntry/Controllers/SearchController.cs; SAIF.SAIFCode.Core package (SAIF.Services assembly) security-authorization findings (SEC-01) |
| Unattributed endpoints | Entry.GetDefaultAssignedToId and Provider.ShowProviderGrid are not called by any screen** |
ClaimBillEntry/Controllers/EntryController.cs:170, ClaimBillEntry/Controllers/ProviderController.cs:39 |
| Dead actions | NoteGrid.Editing_Popup and ServiceGrid.Editing_Popup are not used |
ClaimBillEntry/Controllers/NoteGridController.cs, ClaimBillEntry/Controllers/ServiceGridController.cs |
| Uncompiled ViewModels | Seven files are not compiled: EntryDetailViewModel, EntryHeaderViewModel, the root EntryViewModel, InboxDetailViewModel, SearchDetailViewModel, SearchFilterViewModel and the root SearchViewModel |
ClaimBillEntry/ClaimBillEntry.csproj |
| Commented-out security policy | GlimpseSecurityPolicy.cs is not compiled and fully commented out |
ClaimBillEntry/GlimpseSecurityPolicy.cs |
| Unused ViewModels | InboxFilterViewModel and BillHeaderViewModel are unused |
ClaimBillEntry/ViewModels/Inbox/InboxFilterViewModel.cs |
| Inactive validators | InboxFilterValidator and SearchFilterValidator never run |
Business rules |
| Empty editor templates | Note category and note type editor templates appear unpopulated* | ClaimBillEntry/Views/Shared/EditorTemplates |
| Malformed URL | Url.Action(" SavePreferences") and Url.Action(" ClearPreferences") have a leading space in the search criteria partial |
ClaimBillEntry/Views/Search/_SearchCriteria.cshtml:62,65 |
| Preference actions on every controller | SavePreferences and ClearPreferences are routable on every derived controller |
ClaimBillEntry/Controllers/BaseController.cs:50,70 |
| Unused injected service | IBillEntryService is injected into ServiceGridController but unused |
ClaimBillEntry/Controllers/ServiceGridController.cs |
| Unused HttpClient | An HttpClient for cc.ccclaimdataapiurl is created and never registered |
SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs:47-49 |
| Commented-out registration | RegisterInformationServices is commented out |
SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs:75 |
| Inconsistent lifetimes | Overpayment, location, employee and policy providers use a different lifetime from the other providers | SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs:97,100,103,129-131 |
| Uncompiled facade | IApplicationDependencies is not compiled |
SAIF.DependencyMaps.Web.ClaimBillEntry/IApplicationDependencies.cs |
| Web API with no controllers | Web API is registered with no ApiController, and RegisterAllAreas runs with no areas |
ClaimBillEntry/Global.asax.cs:17,20 |
| Version mismatches | Project targets 4.6.2 while Web.config declares 4.6.1; MVC package 5.2.7 versus referenced assembly 5.2.6.0 |
ClaimBillEntry/ClaimBillEntry.csproj, ClaimBillEntry/Web.config |
| Hard-coded virtual directory | Scripts hard-code /ClaimBillEntry/ |
ClaimBillEntry/js/ClaimBillEntry.entry.js:219 |
| Session coupling | Inbox and send or pend behavior depends on Session values | ClaimBillEntry/Controllers/InboxController.cs, ClaimBillEntry/Controllers/EntryController.cs:195 |
| Unused packages | Seven of fourteen internal packages are not consumed directly; transitive use was not traced** | Dependencies |
| Stray code | Stray usings and a "not sure why" comment | ClaimBillEntry/Views/Entry/EditorTemplates/_AddService.cshtml:6-7 |
Related documentation¶
- Index
- Overview
- Architecture
- Dependencies
- Configuration
- Operations and processes
- Business rules
- Security and authorization
- Data model
- Hosted endpoints
- Screen catalog
Note: Statements marked with
†are derived from dependency library documentation via the Legends CLI. Statements marked with*were inferred from code structure or contextual evidence. Statements marked with**could not be confirmed; treat as unknown until verified.
Sources¶
- Pipelines/build-vars.yml
- ClaimBillEntry/Web.config
- ClaimBillEntry/Views/Web.config
- ClaimBillEntry/ClaimBillEntry.csproj
- ClaimBillEntry/packages.config
- ClaimBillEntry/Controllers/EntryController.cs
- ClaimBillEntry/Controllers/DiagnosisGridController.cs
- ClaimBillEntry/Controllers/ProcedureGridController.cs
- ClaimBillEntry/Controllers/ServiceGridController.cs
- ClaimBillEntry/Controllers/BaseController.cs
- ClaimBillEntry/ViewModels/Entry/ServiceViewModel.cs
- ClaimBillEntry/Views/Search/_SearchCriteria.cshtml
- SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs