Skip to content

Tech debt

The only call site swallows every logging failure silently, never disposes the generated proxy, and always tags error records with a fixed environment name.

CRITICAL

No CRITICAL findings were identified for this proxy.

HIGH

Finding Component Impact Recommended action
A bare catch { } in SAIFExceptionLogger.Log swallows every exception from the logging call, including a possible NullReferenceException while building the request context, with no fallback record beyond Trace.TraceError Services/SAIF.Services.WebApi/EnvironmentApi/App_Start/SAIFExceptionLogger.cs:18-37 When the logging service itself fails, there is no operator-visible signal that error logging has stopped working Not prescribed
The LoggingServiceProxy instance is never disposed at its only call site SAIFExceptionLogger.cs:20 Each logged exception leaves an unclosed ClientBase<T> channel for the garbage collector to clean up Not prescribed
Dispose() calls Close() with no Abort() fallback, even though disposal never happens at the only call site Services/SAIF.Services.Web.Proxies/LoggingServiceProxy.cs:17-20 Were disposal ever added, a faulted channel would throw CommunicationObjectFaultedException from Close() Not prescribed
appSettings["loggingServiceUrl"] in EnvironmentApi/Web.config points to the production host, and neither Web.Debug.config nor Web.Release.config overrides it Services/SAIF.Services.WebApi/EnvironmentApi/Web.config:8 Every build configuration of EnvironmentApi logs errors to the production logging service, regardless of the environment it is actually running in Not prescribed
The environment is hard-coded to "NetProd" for every logged error, regardless of the actual deployment track — see BR-LOG-001 SAIFExceptionLogger.cs:23 Error records cannot be filtered or attributed by their true originating track Not prescribed
No retry, no explicit timeout, and no cancellation exist at the only call site, and the call is synchronous on the request thread LoggingServiceProxy.cs:17-27 A slow or unreachable logging host blocks the Web API request thread for up to the default one-minute send timeout Not prescribed
SAIF.Services.Web.Proxies.dll is referenced by EnvironmentApi through a binary HintPath rather than a project reference or package Services/SAIF.Services.WebApi/EnvironmentApi/EnvironmentApi.csproj:54-55 The binary is not restored by a package manager and is invisible to dependency scanning, so it can drift from this repository's source without detection Not prescribed
The SOAP namespace is left at the generator default (http://tempuri.org/...) with a SAIF-specific path appended Services/SAIF.Services.Web.Proxies/Service References/Logging/clsWSLogging.wsdl:2 The contract carries no fully-owned namespace identity and could collide with another tempuri.org-rooted service during proxy generation Not prescribed

Sources

  • Services/SAIF.Services.Web.Proxies/LoggingServiceProxy.cs
  • Services/SAIF.Services.Web.Proxies/Service References/Logging/clsWSLogging.wsdl
  • Services/SAIF.Services.WebApi/EnvironmentApi/App_Start/SAIFExceptionLogger.cs
  • Services/SAIF.Services.WebApi/EnvironmentApi/Web.config
  • Services/SAIF.Services.WebApi/EnvironmentApi/EnvironmentApi.csproj