12 lines
2.4 KiB
JSON
12 lines
2.4 KiB
JSON
{
|
|
"auditId": "p-rec-bop-plant3d-2019-document-generation",
|
|
"sourceRoot": "\\\\phpsrv03\\NBIM\\code\\CS\\P_Rec_BOP\\repo",
|
|
"sourceHead": null,
|
|
"findings": [
|
|
{"id":"DOC-001","category":"DocumentGeneration","severity":"HIGH","title":"Office PIA and hard-coded Word structure","description":"The project embeds Office Word PIA 15 and addresses tables, sections and cells by numeric indexes.","evidence":[{"file":"P_Rec_BOP/P_Rec_BOP.csproj","startLine":90,"endLine":99},{"file":"P_Rec_BOP/Worder.cs","startLine":326,"endLine":345},{"file":"P_Rec_BOP/Worder.cs","startLine":812,"endLine":850}],"impact":"Version, bitness and template changes can prevent startup or corrupt mapping.","recommendation":"Isolate Word worker and replace numeric slots with validated schema identifiers.","reuseClassification":"REIMPLEMENT_WITH_SAME_BEHAVIOR"},
|
|
{"id":"PLANT-001","category":"PlantData","severity":"HIGH","title":"Plant data is read through project DCF files","description":"Piping.dcf and ProcessPower.dcf are opened directly and queried into DataSets.","evidence":[{"file":"P_Rec_BOP/Program.cs","startLine":191,"endLine":283}],"impact":"DCF schema and file access must be verified for 2026.","recommendation":"Create versioned Plant data adapters and golden data fixtures.","reuseClassification":"USE_AS_REFERENCE_ONLY"},
|
|
{"id":"INFRA-001","category":"Infrastructure","severity":"HIGH","title":"AutoCAD 2019 and network paths are configured explicitly","description":"Settings contains AutoCAD 2019 accoreconsole and external network resources.","evidence":[{"file":"P_Rec_BOP/Settings.xml","startLine":7,"endLine":24}],"impact":"Missing or changed resources stop or alter generation.","recommendation":"Use validated configuration and a 2026 adapter; do not hard-code production paths.","reuseClassification":"REIMPLEMENT_WITH_SAME_BEHAVIOR"},
|
|
{"id":"COM-001","category":"WordInterop","severity":"HIGH","title":"COM cleanup is incomplete","description":"The code closes and quits Word but does not explicitly release all COM proxies and catches errors before copying output.","evidence":[{"file":"P_Rec_BOP/Worder.cs","startLine":372,"endLine":380},{"file":"P_Rec_BOP/Worder.cs","startLine":383,"endLine":420},{"file":"P_Rec_BOP/Worder.cs","startLine":508,"endLine":519}],"impact":"WINWORD.EXE leaks and partial output are possible.","recommendation":"Implement one STA job per operation with finally-based cleanup and output validation.","reuseClassification":"DO_NOT_REUSE"}
|
|
]
|
|
}
|