CSI baseline CSI-IFX-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.
Informix4GL Demo: action plan
In this document
Dated baseline: 22 October 2026 · Proposed work; no remediation completed
The first decision to make
Resolve the iText identity and use questions before selecting the change. The unsupported-family correlation is concrete enough to justify that work. The advisory range provides a second reason to investigate the same jar, but its application applicability depends on additional parser and input evidence. IFX-S-E0014 IFX-S-ITEXT-EOL IFX-S-XXE
The sequence below is ordered by the evidence needed for the next decision. It does not assign a production severity, deadline or delivery estimate.
Sequence and reviewable outputs
| Step | Work | Output needed for review | Linked tasks and findings |
|---|---|---|---|
| 1. Bind the assessed environment | Identify the source and build, exact jars, server edition/fix pack, image digest, Java and JDBC versions, and the setup route actually used. | A component inventory tied to one build and environment, with hashes/manifests and explicit remaining unknowns. | IFX-V-001; IFX-F-001 to IFX-F-004 |
| 2. Resolve iText use and parser applicability | Inspect the framework or a trustworthy use map; separate report generation from PDF/XML parsing; trace relevant input origins and controls. | A cited use map and a reasoned CVE-2017-9096 disposition for the assessed build. | IFX-V-002; IFX-F-001, IFX-F-002 |
| 3. Capture behaviour before change | Run the agreed report-destination and order/invoice scenarios against the identified executable. | Baseline outputs, database outcomes and observations for success, failure, exception and monetary cases. | IFX-V-003, IFX-V-004 |
| 4. Select the PDF/library decision | If the jar is proven unused, consider removal. If required, assess a supported library or framework target and the required code, packaging and licence changes. | A bounded change proposal, affected callers, compatibility decisions and regression scope. | IFX-F-001; IFX-F-002 if applicable; IFX-V-002 to IFX-V-004 |
| 5. Verify any selected server upgrade | Select an exact target, check IBM's target requirements, provision Java, pin inputs and validate JDBC and application behaviour. | Reproducible environment details, installation/startup evidence and regression results. | IFX-F-003; IFX-V-005 |
| 6. Record finding dispositions | Review each finding against its own acceptance evidence and retain the previous assessment. | An updated dated record stating what changed, why, and which unknowns remain. | IFX-F-001 to IFX-F-004 |
Evidence informing this plan: IFX-S-PROVENANCE IFX-S-E0014 IFX-S-E0012 IFX-S-C13 IFX-S-ITEXT-EOL IFX-S-XXE IFX-S-IBM-JRE IFX-S-IBM-20515.
Decision criteria for each finding
IFX-F-001: support
Close or revise the declaration-based finding only when the assessed distribution and the resulting decision are evidenced. If the jar is absent, document the corrected scope. If it is removed, show why it was unnecessary and record the relevant regressions. If it is replaced, record the supported target, required compatibility changes and behaviour checks. A parser-specific CVE rejection alone does not resolve the separate support issue. IFX-S-ITEXT-EOL IFX-S-E0014 IFX-S-E0012
IFX-F-002: vulnerability candidate
Record a disposition that answers package identity, affected code, runtime use, input origin and relevant controls. If a required condition cannot be established, keep it explicitly unresolved. If evidence rules the condition out for a particular build or path, record that boundary. If applicability is confirmed and a change is made, retain the replacement's relevant fix evidence and subsequent validation. IFX-S-XXE IFX-S-E0012
IFX-F-003: upgrade compatibility
Apply the Java packaging requirement to the actual selected target. Record whether the existing environment satisfies it or what will be provisioned. The review should include server installation and tools as well as the application runtime; a generic launcher declaration is insufficient. Keep the finding conditional until a target and environment are bound. IFX-S-IBM-JRE IFX-S-C10
IFX-F-004: rejected declared-version match
Preserve the xC5 fix comparison. Do not reopen the same family-only candidate without new evidence, and do not use it to close an alert on an unidentified server. If inventory finds a different build, evaluate that build and retain both the original rejection and the new result. IFX-S-IBM-20515 IFX-S-E0014
Behaviour that the change proposal must address
The framework's report lifecycle is incompletely known. The proposal should therefore name the actual callers and destinations it will cover, with captured examples for mailing labels and accounts receivable. Invoice generation belongs in the order regression scope because it follows successful commit in the documented Java path. IFX-S-E0012 IFX-S-C13
For order failures, preserve the distinction between explicit rollback branches and the broad exception path. For totals, compare the displayed order total with the invoice calculation using fractional-cent cases; the unavailable Money implementation prevents assuming the two paths round identically. These are targeted characterisation questions, not established defects. IFX-S-E0012 IFX-S-C13
Completion record
For each completed task, retain the named build and environment, input conditions, observations, reviewer decision and remaining uncertainty. Update the component, finding and relationship records together so that a resolved edge is supported by evidence. Keep the 22 October 2026 baseline available for comparison. No task in this plan has been executed by this report publication.
This Wayfinder CSI assessment is limited to the registered source set. Findings, inference, recommendations and evidence gaps remain distinct. It does not establish a completed migration, production suitability or functional equivalence.
Independent Harten analysis of the Informix4GL Demo source material. No maintainer endorsement is implied. The exact analysed upstream revision remains unbound. The source records do not establish runtime behaviour or equivalence between the 4GL and Java implementations.
Inspect the evidence and external lookups · Read the existing application documentation edition.