GovTech Modernization · Read-only Audit Findings
e-District Uttarakhand
Legacy ASP.NET Web Forms citizen-services portal assessed across four independent lenses — security, maintainability, complexity, and testability — with an evidence-backed migration plan.
CriticalHighMediumLow
Platform
.NET 3.5
Web Forms · VS2008
Codebase
~2,150
files · ~91.6K VB LOC
Security posture
CRITICAL
5 critical findings
Test coverage
0%
no tests · no CI
Target
.NET 10
Blazor · C# · LTS
Risk posture
four lenses
CRITICAL
Security
Poor
Maintainability
High
Complexity (concentrated)
None
Testability
Findings by severity
per register
Secrets exposed
active-incident grade
Plaintext DB credentials, API key & session key in web.config F-05
Private signing certificate committed and made web-downloadable F-04
Open DocUp.ashx hands out other people's documents F-02
→ Closed first, in Phase 0 (days, not months).
Consolidated risk heatmap
modules × four lenses · click a row or cell
Security
Debt
Complexity
Test
Root-cause convergence — one defect, seen four ways
| Root cause | Security | Tech Debt | Complexity | Test |
|---|---|---|---|---|
| DAL bypass + inline string-concatenated SQL closes U-4 | F-01F-02F-03 | TD-04TD-06TD-09TD-16 | 5.6 | CG-06 |
| Logic trapped in fat Page_Load / handlers closes U-8 | F-08 | TD-08 | H1H5H12 | CG-01CG-04CG-05 |
| No verification fabric (no tests / compile / logging) closes U-3 | (enables all) | TD-01TD-02TD-03TD-07 | 7 | whole audit |
| God classes / god modules closes U-8 | — | TD-05 | C1C3C6 | CG-06 |
| Copy-paste duplication of files/logic closes U-7 | F-17 | TD-11TD-12 | 5.5 | CG-22CG-24 |
| Secrets in source / web-downloadable closes U-1 | F-04F-05 | TD-21 | — | — |
The big-ticket items are not separate problems. Fixing the root cause once retires findings across all four registers — which is why U-4 (centralize data access) is the single highest-leverage move in the codebase.
Risk register
· · ·
| ID | Finding | Severity | Effort | Priority | Location |
|---|---|---|---|---|---|
| F-01 | Systemic SQL injection via string-concatenated SQL | Critical | L | P0 | ~190 files · BL.vb, Dal.vb |
| F-02 | Unauthenticated SQLi + document IDOR in DocUp.ashx | Critical | S | P0 | Certificates/Preview/DocUp.ashx |
| F-03 | Unauthenticated web-service SQLi (mobile API) | Critical | M | P0 | WSM.vb, Edistmservice.vb |
| F-04 | Private signing cert committed & web-downloadable | Critical | S | P0 | nicesign.pfx · web.config |
| F-05 | Plaintext DB credentials, API key & session key | Critical | S | P0 | web.config |
| F-06 | Verbose errors + debug enabled; exceptions reflected | High | S | P1 | web.config · multiple pages |
| F-07 | Broken/absent framework authorization | High | M | P1 | web.config · no LoginPage/web.config |
| F-08 | Weak auth & credential storage (unsalted MD5) | High | L | P1 | SecureSewaLogin.aspx.vb |
| F-09 | ValidateRequest="false" + reflected XSS | High | M | P1 | login / edit pages |
| F-10 | Web services via HttpGet/HttpPost + WSDL metadata | High | S | P1 | web.config |
| F-11 | Sensitive data export from public / unauth services | High | M | P1 | Download.aspx.vb |
| F-12 | No CSRF protection / ViewStateUserKey absent | Medium | M | P2 | app-wide |
| F-13 | Weak machineKey (3DES, auto-generated) | Medium | S | P2 | web.config |
| F-14 | Transport/cookie hardening gaps | Medium | S | P2 | web.config |
| F-15 | Session management weaknesses | Medium | M | P2 | web.config · login |
| F-16 | Excessive request size + IDOR file handling | Medium | S | P2 | file handlers |
| F-17 | Duplicated code/config trees multiply attack surface | Low | L | P3 | *1 forks · bin - Copy |
| TD-01 | No automated tests anywhere | Critical | L | P1 | — |
| TD-02 | Website-project model → runtime-only errors | Critical | L | P1 | — |
| TD-03 | Swallowed exceptions, no central logging | Critical | M | P1 | — |
| TD-04 | ADO.NET boilerplate never centralized (DAL bypassed) | Critical | L | P1 | — |
| TD-05 | God classes mixing unrelated responsibilities | High | L | P1 | — |
| TD-06 | Inline SQL string concatenation app-wide | High | L | P1 | — |
| TD-08 | Business logic + auth in presentation layer | High | L | P1 | — |
| TD-11 | Massive page/folder duplication (copy-paste forks) | High | L | P1 | — |
| TD-13 | EOL platform: .NET 3.5 / Web Forms / VS2008 | High | L | P1 | — |
Complexity hotspots
| File | Function | LOC | CC | Cog | Nest | Pri |
|---|---|---|---|---|---|---|
| ApprovalReport1.aspx.vb | Page_Load | 314 | 76 | 268 | 6 | P0 |
| ApprovalReport.aspx.vb | Page_Load | 277 | 77 | 258 | 6 | P0 |
| RemarkNewApplication.aspx.vb | Page_Load | 280 | 65 | 227 | 6 | P0 |
| SecureSewaLogin.aspx.vb | btn_login_Click | 277 | 30 | 173 | 10 | P0 |
| MasterPage.master.vb | btn_login_Click | 261 | 28 | 171 | 10 | P0 |
| Foodlicenes.aspx.vb | checkentry | 366 | 81 | 150 | 4 | P1 |
| DeathRegistration.aspx.vb | checkentry | 322 | 73 | 147 | 4 | P1 |
| WidowPensionRural.aspx.vb | checkentry | 357 | 80 | 126 | 3 | P1 |
| DomicileCertificate.aspx.vb | checkentry | 298 | 65 | 139 | 4 | P1 |
| receipt.aspx.vb | Page_Load | 199 | 59 | 170 | 5 | P1 |
God modules
size = risk
WebServicem.vb2,173 LOC · 55 methods
BL.vb2,176 LOC · 87 methods
Edistmservice.vb1,941 LOC · 40 methods
WSM.vb1,433 LOC · 42 methods
Dal.vb590 LOC · 18 methods
Breadth, not depth: BL.vb has 87 mostly-simple methods but is called app-wide — fragile to touch. WebServicem.vb has methods taking up to 20 parameters.
~89
dangerous functions
91.6%
functions simple (CC≤10)