---
title: Application tech debt register
summary: Consolidated CRITICAL and HIGH tech debt findings from all LegalMaintenance library analyses.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-08-21
---

# Application tech debt register

This page consolidates all CRITICAL and HIGH severity tech debt findings from all LegalMaintenance library analyses. No CRITICAL-severity findings were identified; all findings below are HIGH severity.

## Critical findings

No CRITICAL-severity findings were identified in the analyzed libraries.

## High findings

| Library | Finding | Impact | Recommended action |
| --- | --- | --- | --- |
| LegalMaintenance | NTLM/Windows-integrated authentication with no `<authorization>` element in `Web.config`, so ASP.NET defaults to `<allow users="*"/>`; all URL-level access control is delegated to IIS configuration outside the application. | Access control depends entirely on infrastructure configuration that cannot be verified from code, risking silent over-permissive access. | Add an explicit `<authorization>` section (or equivalent role checks) in the application and confirm IIS-level ACLs are actually restrictive. |
| LegalMaintenance | `frmAttorneyProfile`'s whole-page `IsViewOnly` lockdown is dead code: `SecurityRole` remains `NoAccess` for the page lifetime, so `IsViewOnly` always evaluates `False` and intended read-only enforcement never executes. | View-only users can perform edits the UI intends to block. | Fix the `SecurityRole` assignment/initialization so `IsViewOnly` reflects actual AD group membership, and add a regression test for the view-only path. |
| LegalMaintenance | `DataHelper.aspx` is an ungated AJAX mutation endpoint: it bypasses the shared page ancestor, performs no authorization check, accepts a client-supplied `ViewID`, and wraps the call to `clsAttorneyTableManager.ProcessAjaxRequest` in an empty catch that silently swallows errors. | A user in the view-only (`LNView`) group can mutate data through this path, and errors are hidden from the caller. | Add explicit authorization checks before dispatching the AJAX request, validate/allow-list `ViewID`, and replace the empty catch with logged error handling. |
| LegalMaintenance | `<pages enableEventValidation="false">` disables ASP.NET's postback integrity checks, allowing a client to re-enable a disabled toolbar button and post back actions that should be blocked. | Client-side UI state (e.g., disabled buttons in view-only mode) can be bypassed via crafted postbacks. | Re-enable event validation (or apply page-specific overrides only where strictly required) and add server-side re-validation of button state on postback. |
| LegalMaintenance | `frmHearingLocation.aspx` has an inverted empty-collection guard combined with a fallback manager type-cast bug, and `frmRotation.aspx` has a similar fallback manager type mismatch hidden by a try/catch. | Both can cause the wrong manager instance to be used silently, producing incorrect behavior without a visible error. | Correct the guard logic/type casts and remove the swallowing try/catch so mismatches surface as actionable errors. |
| LegalMaintenance | `LNView`'s semantics are inverted relative to its name: `IsInViewOnly` returns `True` when the principal **is** in the `LNView` AD group (triggering read-only mode), while users in no legal group at all get a fully enabled toolbar. | The permission model may not match its intended design, risking incorrect access grants; unconfirmed by any domain SME. | Confirm intended semantics with a domain SME, rename the group/check or invert the logic to match intent, and add explicit tests for both membership states. |
| [SAIF.Business.View.Provider](../libraries/saif-business-view-provider/overview.md) | `clsProviderCollection` builds SQL via unparameterized string concatenation in two places: a tax-ID `IN` list and a caller-supplied `WHERE` clause appended verbatim with no bind variables. | SQL-injection risk if any caller-controlled value reaches these paths. | Replace string concatenation with parameterized/bound queries; constrain caller-supplied WHERE clauses to a validated predicate builder. |
| [SAIF.Business.Tasks](../libraries/saif-business-tasks/overview.md) | Task search SQL is built via unsafe string interpolation (`FormatOtherParameters`/`FormatContextParameters`), embedding user-supplied text with no bind variables/escaping, and formatting `CONTEXT_DATE` as a locale-dependent literal instead of `TO_DATE(...)`. | SQL-injection risk and locale-dependent date parsing failures. | Parameterize all task-search predicates with bind variables and use explicit `TO_DATE`/format-mask handling for date literals. |
| [SAIF.Business.Tasks](../libraries/saif-business-tasks/overview.md) | `TaskPriority.Urgent` emits a malformed SQL fragment appended after an already-open `IN (` clause, producing an unbalanced/invalid predicate. | Task searches filtered by the `Urgent` priority may fail or behave incorrectly. | Fix the fragment builder to close the `IN (...)` clause correctly before appending additional predicates, and add a unit test asserting well-formed SQL. |
| [SAIF.Business.Claim.Legal](../libraries/saif-business-claim-legal/overview.md) | Attorney assignment/calendar-sync side effects (real e-mail, real Exchange calendar writes) are gated by an environment check driving a `testing` flag; if the environment is misclassified, non-production environments can perform real-world side effects. | Non-production testing could trigger real e-mail/calendar actions affecting real attorneys/schedules. | Add defensive environment verification (e.g., fail-safe default to test mode, explicit environment allow-list) and alerting if the environment check itself fails. |
| [SAIF.Application](../libraries/saif-application/overview.md) | `ServiceResponse.ProcessException` contains an infinite-loop bug: it reassigns `LocalEX = ex.InnerException` on every iteration instead of `LocalEX.InnerException`, so a loop intended to walk the inner-exception chain never advances past the first inner exception. | Exception chain traversal fails for 2+ levels of nesting, and can loop indefinitely if implemented as a `while` construct. | Fix the reassignment to `LocalEX = LocalEX.InnerException` and add a null-terminating loop condition with a maximum iteration guard. |
| [SAIF.Services.Appworx](../libraries/saif-services-appworx/overview.md) | `submit_appworx_job` stored-procedure invocation swallows a `NO_DATA_FOUND` condition rather than surfacing it to the caller. | Failed/no-op batch job submissions may appear to succeed, hiding operational failures. | Propagate `NO_DATA_FOUND` (and other proc-level failures) as an explicit result/exception so callers can detect and retry failed submissions. |

## Summary

| Severity | Count |
| --- | --- |
| CRITICAL | 0 |
| HIGH | 11 |
| **Total** | 11 |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Data model](data-model.md)

## Sources
- LegalMaintenance web application (LegalMaintenance/*.aspx.vb)
- LegalMaintenance web application (LegalMaintenance/*.aspx.vb)
- [SAIF.Business.View.Provider](../libraries/saif-business-view-provider/overview.md)
- [SAIF.Business.Tasks](../libraries/saif-business-tasks/overview.md)
- [SAIF.Business.Claim.Legal](../libraries/saif-business-claim-legal/overview.md)
- [SAIF.Application](../libraries/saif-application/overview.md)