Files

T

Joseph Doherty 819f1b4665 fix(validation): close Theme 3 — 11 input-validation / unbounded-input findings

Each finding is a focused validation guard or upper bound at a trust boundary.
Highlights:
- Commons-015: EncryptionMetadata ctor now validates Algorithm (AES-256-GCM
  only), Kdf (PBKDF2-SHA256 only), Iterations ([100k, 10M]), non-null Salt/IV.
- Transport-004: new BundleUnlockRateLimiter (sliding-window, per-key,
  singleton) wired into BundleImporter.LoadAsync; over-budget callers see
  BundleUnlockRateLimitedException. Per-bundle 3-strike + per-window cap.
- ESG-022: ExternalSystemClient.InvokeHttpAsync allow-lists the documented
  GET/POST/PUT/PATCH/DELETE set (case-insensitive); unknown verbs throw.
- SEL-015: SiteEventLogger queue now bounded (10k cap, DropOldest); dropped
  events fault their Task and increment FailedWriteCount so the drop is
  observable instead of an unbounded memory growth.
- SEL-017: EventLogQueryService clamps caller-supplied PageSize to a new
  MaxQueryPageSize cap (default 500) so int.MaxValue can't OOM the host.
- SEL-020: LogEventAsync rejects severities outside {Info, Warning, Error}
  (matches SQLite BINARY-collation query filter).
- InboundAPI-020: ContentType "json" check now case-insensitive
  (application/JSON no longer slips through as not-json).
- InboundAPI-024: _knownBadMethods capped at 1000 entries (drops new entries
  once full); per-request DB lookup remains the correctness path.
- SR-025: HandleSetStaticAttribute validates the attribute name against the
  deployed config; unknown names now return Success=false instead of
  leaking orphan override rows into the SQLite store.
- TE-021: MoveTemplateAsync runs the sibling-name-collision check at the
  destination, mirroring TemplateFolderService.MoveFolderAsync.
- TE-022: LockEnforcer's once-locked-stays-locked rule now also covers
  LockedInDerived (was previously only IsLocked).

New regression tests across 8 test projects (EncryptionMetadata, rate
limiter, ESG client allow-list, SEL bounded channel / PageSize clamp /
severity validation, InboundAPI ContentType + bad-methods cap, SiteRT
unknown-attribute, TemplateEngine MoveTemplate + LockedInDerived).
Build clean; affected suites all green. README regenerated: 93 open (was 104).

Note: a separate manual re-run was needed for the SiteEventLogging hunk
because its initial subagent's source edits never landed on disk despite
reporting success (file-collision-style failure mode).

2026-05-28 06:58:25 -04:00

19 KiB

Raw Blame History

Code Reviews

Comprehensive, per-module code reviews of the ScadaLink codebase. Each module (one buildable project under src/) has its own folder containing a findings.md. This README is the aggregated index — the single place to see all outstanding work.

Generated by regen-readme.py from the per-module findings.md files. Do not edit by hand — edit the findings files and re-run the script.

How it works

Reviews are performed one module at a time against a fixed checklist.
Every finding is recorded in the module's findings.md with a severity and status.
Findings are never deleted — they are closed by changing their status, keeping a full audit trail.
This README aggregates every pending finding (Open / In Progress) across all modules.

See REVIEW-PROCESS.md for the full procedure: the review checklist, severity definitions, finding format, and how to mark items resolved.

Layout

code-reviews/
├── README.md            # this file — process overview + pending findings
├── REVIEW-PROCESS.md     # how to perform a review and track findings
├── regen-readme.py       # regenerates this README from the findings files
├── _template/findings.md # copy-this template for a module review
└── <Module>/findings.md  # one folder per src/ project

Baseline review — 2026-05-16

All 19 modules were reviewed at commit 9c60592 (241 findings: 6 Critical, 46 High, 100 Medium, 89 Low). The tables below track what remains open as findings are resolved and re-triaged; findings discovered after the baseline are appended to their module file and counted in Total.

Severity	Open findings
Critical	0
High	0
Medium	32
Low	61
Total	93

Module Status

Module	Last reviewed	Commit	Open (C/H/M/L)	Open	Total
AuditLog	2026-05-28	`1eb6e97`	0/0/3/6	9	11
CLI	2026-05-28	`1eb6e97`	0/0/2/3	5	23
CentralUI	2026-05-28	`1eb6e97`	0/0/0/5	5	33
ClusterInfrastructure	2026-05-28	`1eb6e97`	0/0/0/3	3	14
Commons	2026-05-28	`1eb6e97`	0/0/0/5	5	23
Communication	2026-05-28	`1eb6e97`	0/0/1/4	5	22
ConfigurationDatabase	2026-05-28	`1eb6e97`	0/0/3/2	5	24
DataConnectionLayer	2026-05-28	`1eb6e97`	0/0/0/0	0	22
DeploymentManager	2026-05-28	`1eb6e97`	0/0/1/4	5	24
ExternalSystemGateway	2026-05-28	`1eb6e97`	0/0/2/1	3	23
HealthMonitoring	2026-05-28	`1eb6e97`	0/0/1/3	4	23
Host	2026-05-28	`1eb6e97`	0/0/1/5	6	22
InboundAPI	2026-05-28	`1eb6e97`	0/0/2/2	4	25
ManagementService	2026-05-28	`1eb6e97`	0/0/2/1	3	23
NotificationOutbox	2026-05-28	`1eb6e97`	0/0/1/2	3	10
NotificationService	2026-05-28	`1eb6e97`	0/0/2/2	4	25
Security	2026-05-28	`1eb6e97`	0/0/0/2	2	21
SiteCallAudit	2026-05-28	`1eb6e97`	0/0/2/2	4	6
SiteEventLogging	2026-05-28	`1eb6e97`	0/0/0/3	3	23
SiteRuntime	2026-05-28	`1eb6e97`	0/0/2/0	2	26
StoreAndForward	2026-05-28	`1eb6e97`	0/0/3/3	6	24
TemplateEngine	2026-05-28	`1eb6e97`	0/0/3/0	3	22
Transport	2026-05-28	`1eb6e97`	0/0/1/3	4	12

Pending Findings

Every Open / In Progress finding across all modules, highest severity first. Resolved findings drop off this list but remain recorded in their module's findings.md (see REVIEW-PROCESS.md §4–§5). Full detail — description, location, recommendation — lives in the module's findings.md.

Critical (0)

None open.

High (0)