Source-derived document; reported behaviour, inference and evidence gaps are identified in the text.

Return to: Security boundaries

Security boundaries

Where do trust or privileges change, which flows cross those boundaries, and what controls are evidenced?

This view identifies evidenced trust or privilege changes around customer-form input, application processing, and persistence in the stores7 database. The customer forms accept user-entered fields and map them to customer columns; the executable source then performs database queries and customer/order mutations. E0007

Read the view as two crossings: entered form data crosses into application handling, and application operations cross into database persistence. The evidence shows input constraints, confirmation checks, and transaction rollback for order insertion, but it does not establish authentication, authorization, transport protection, database privilege separation, or runtime deployment. Missing controls are not proof of vulnerabilities or of adequate security. E0007 E0008

Diagram

flowchart LR
  n6f22b936faf98f2d4f54["Application user (inferred)"]
  n4900f70670f44405b664["Customer input boundary (inferred)"]
  n819f8497f926a181327f["Customer application"]
  n0ea2f9248ea2ba7c162b["Stores7 database"]
  n4900f70670f44405b664 -->|"Form data entry"| n819f8497f926a181327f
  n819f8497f926a181327f -->|"Customer persistence"| n0ea2f9248ea2ba7c162b
  n819f8497f926a181327f -->|"Order transaction"| n0ea2f9248ea2ba7c162b

Elements

Application user

Kind: actor

Basis: inferred

Description: The documented application user can add, find, update, and delete customers, and can enter orders and select report destinations through menus and forms. E0007

Evidence: E0007

Goal: Manage customer records and enter or review application data through the supplied menus and forms. E0007

Customer input boundary

Kind: boundary

Basis: inferred

Description: Customer form input is the boundary where values supplied through INPUT BY NAME are accepted before customer operations use them. The forms expose customer number, names, company, addresses, city, state, ZIP code, and phone fields. E0007

Evidence: E0007

Customer application

Kind: component

Basis: reported

Description: The executable 4GL application presents customer operations, constructs customer queries, inserts and updates customer rows, confirms deletions, and handles order insertion and reporting. E0007

Evidence: E0007

Stores7 database

Kind: external_system

Basis: reported

Description: The application declares the stores7 database and accesses customer and related business tables. One published configuration identifies an Informix JDBC connection for stores7; another published project configuration identifies a different Informix host, port, server, and password. E0007 E0008

Evidence: E0007 E0008

Relationships

Form data entry

From: Customer input boundary

To: Customer application

Relation: crosses

Basis: reported

Description: Customer form values cross from the form into application input handling through INPUT BY NAME; the source maps those fields to the customer record and supports field help and interruption during entry. E0007

Trust change: User-entered values become application-controlled customer data used by insert, update, query, and delete operations. E0007

Control: The customer number is marked NOENTRY in one form, the state field uses UPSHIFT, and the telephone field uses a picture mask. These controls constrain presentation or entry format, but input validation, authentication, and authorization are unverified. E0007

Information: Customer number, names, company, addresses, city, state, ZIP code, and telephone data. E0007

Mechanism: Screen field mappings and INPUT BY NAME. E0007

Evidence type: Source declaration and executable-source report. E0007 Evidence: E0007

Customer persistence

From: Customer application

To: Stores7 database

Relation: crosses

Basis: reported

Description: Customer operations cross into the database through customer selection queries, inserts, updates, and deletes. Deletion requires a selected customer, confirmation by y or Y, and no matching orders. E0007

Trust change: Application-provided customer operations become database reads or mutations in the customer table. E0007

Control: Deletion confirmation and the active-order deletion block are evidenced. The customer insert path has no explicit status check after INSERT, and the supplied evidence does not establish transaction handling for customer creation; those controls are therefore unverified. E0007 E0008

Information: Customer identity and contact fields, including address and telephone data, are queried or persisted. E0007

Mechanism: Informix SQL statements through the customer-management routines. E0007

Evidence type: Executable-source report and qualified source synthesis. E0007 E0008 Evidence: E0007 E0008

Order transaction

From: Customer application

To: Stores7 database

Relation: crosses

Basis: reported

Description: Order entry crosses into database persistence by inserting an order and its item rows. The application begins a transaction, obtains a generated order number, inserts item rows, commits only when both insertion stages succeed, and rolls back when an insertion fails. E0007

Trust change: User-entered order and line-item data becomes committed order data, or is discarded through rollback when the documented insertion path reports failure. E0007

Control: Transaction begin, conditional commit, and rollback on order or item insertion failure are evidenced. The evidence does not establish caller authentication, authorization, least-privilege database accounts, or protection of the configured database credentials. E0007 E0008

Information: Order date, purchase order number, shipping instructions, stock and manufacturer selections, quantities, and calculated item totals. E0007

Mechanism: 4GL transaction control and database inserts. E0007

Evidence type: Executable-source report and help documentation. E0007 Evidence: E0007 E0008

Gaps

The supplied evidence does not identify an authentication or authorization boundary for the application user, nor does it show user roles, database grants, session identity, or privilege checks. Their absence in the supplied material does not prove that those controls are absent. E0007 E0008

The two published database configurations disagree on endpoint and password, and the evidence does not establish precedence, environment, or which configuration is used at runtime. Plaintext credentials are reported in both configurations, but actual exposure, reachability, and privilege scope are unverified. E0007 E0008

The form artifacts include binary files that were not semantically analyzed, and additional runtime form dependencies are not established as present or consistent. Follow-up should compare the deployed forms and runtime configuration with the executable source. E0008

The customer insert path requires source review or controlled execution to determine how failed inserts affect SQLCA.SQLERRD[2] and the reported success result. No assurance about successful or failed persistence can be made from the supplied documents alone. E0007 E0008

Recovery limitations

• Ownership, mechanism or boundary controls remain explicitly unverified.
• Some identified concepts have no supported connection.
• The view includes explicitly marked inference.

Sources

• E0007 — SHA256 ce6dd2b00b79f008ecb98935db9ed709c044218bcdd4143008d56d06a04cff97
• E0008 — SHA256 1713f4e3d42ac5e2af28387ac6ff649f06bbe1683b11869af71326929d6a5f32