Technical Analysis Report — NorthgatePortal

01 — Executive Summary

847

Files Analyzed

102,405

Lines of Code

14

Outdated Libraries

3

Critical Issues

3

Projects Scanned

02 — Project Structure

Project	Type	.vb / .cs Files	Lines of Code	Target Framework
NorthgatePortal.Web	ASP.NET Web Forms	312	48,420	.NET Framework 4.5
NorthgatePortal.Business	VB.NET Class Library	298	31,105	.NET Framework 4.5
NorthgatePortal.Data	VB.NET Data Access	237	22,880	.NET Framework 4.5
Total	—	847	102,405	—

03 — Dependency Analysis (NuGet Packages)

Package	Current Version	Latest	Status	Notes
EntityFramework	6.0.0	9.0.1	Critical	CVE-2023-44487 known
WebGrease	1.5.2	Archived	Critical	Unmaintained since 2015
Antlr	3.4.1.9004	4.13.1	Critical	Major breaking changes
Newtonsoft.Json	9.0.1	13.0.3	Warning	Breaking changes in v13
log4net	1.2.10	2.0.17	Warning	Security patches in 2.x
Microsoft.AspNet.WebApi	5.2.3	5.2.9	Warning	Patch available
Autofac	4.9.1	8.2.0	Warning	API changes in v5+
MsTest.TestFramework	1.4.0	3.6.3	Info	Test framework only
Unity	4.0.1	5.11.11	Info	Minor updates
NLog	4.5.11	5.3.4	Info	Non-breaking
Moq	4.10.1	4.20.72	Info	Non-breaking

04 — Code Quality Findings

📄

312

Web Forms Pages (.aspx)

Deprecated in .NET 6+; no upgrade path within Web Forms

📋

47

Inline SQL Queries

Raw string SQL detected; potential injection vectors

🏛

8

God Classes

Classes exceeding 500 lines; BenefitsManager.vb at 1,247 lines

⚠

156

Unhandled Methods

Methods with no Try/Catch error handling

🔗

23

Session State Calls

HttpContext.Current.Session usage; migration-sensitive

🔑

3

Hardcoded Credentials

Connection strings embedded in Web.config

🔄

67

Async Opportunities

Synchronous I/O methods that could be async

📦

4

Circular References

Cross-project dependencies forming cycles

05 — Security Findings

Severity	Finding	File : Line	Recommendation
Critical	SQL Injection risk (string concatenation)	`BenefitsManager.vb:847`	Use parameterized queries
Critical	ViewState MAC validation disabled	`Web.config:14`	Set enableViewStateMac="true"
Critical	MD5 used for password hashing	`AuthHelper.vb:23`	Replace with bcrypt or SHA-256
Warning	Missing HTTPS redirect	`Global.asax:1`	Add RequireHttpsAttribute
Warning	Stack traces exposed in error pages	`ErrorHandler.vb:88`	Sanitize error output
Warning	Missing X-Frame-Options header	`Web.config`	Add security headers
Info	Outdated TLS configuration	`Web.config:22`	Require TLS 1.2+ only

06 — Modernization Complexity Estimate

UI Layer (Web Forms → Blazor / Razor Pages) 80% — High

Authentication (Forms Auth → ASP.NET Core Identity) 70% — High

Data Access (EF6 → EF Core) 55% — Medium

Business Logic 30% — Low-Medium (mostly portable)

Test Coverage 20% — Low