@portll/cobolwork 0.0.1 → 0.2.75

package/lib/sets/build.mjs

@@ -0,0 +1,234 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// What the build pins, and whether anyone has published an advisory against it.
+//
+// A crafted source file in a pull request targets the compiler that CI runs on it. Every GnuCOBOL
+// advisory on record is exactly that shape - "via crafted COBOL source code" - so the version a
+// repository's build pins is part of its attack surface, and it is written down in files no COBOL
+// rule set reads.
+import { inScope, relPath } from '../sources.mjs';
+import { byText } from '../kernel/findings.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { advisoriesFor, advisoryFeedPaths, loadAdvisoryFeed, COVERAGE } from '../advisories.mjs';
+import { isKnownExploited, kevAge } from '../kev.mjs';
+import { loadSite } from '../site.mjs';
+import { basename } from 'node:path';
+
+
+export const BUILD_RULES = {
+  'build-pins-vulnerable-compiler': {
+    sev: 'high', evidence: 'advisory', cwe: 'CWE-1395',
+    text: 'The build pins a compiler version with a published advisory against it',
+    impact: 'The build compiles every pull request with a compiler version a published advisory affects, so a crafted source file can exploit it in CI',
+    remedy: 'Upgrade the pinned compiler to a fixed version, or pin one no listed advisory affects',
+  },
+  'build-pins-exploited-compiler': {
+    sev: 'crit', evidence: 'advisory', cwe: 'CWE-1395',
+    text: 'The build pins a compiler version with a vulnerability CISA lists as known to be exploited',
+    impact: 'The pinned compiler has a vulnerability CISA lists as known to be exploited, and CI compiles untrusted source with it',
+    remedy: 'Upgrade the pinned compiler to a fixed version now; this one is being exploited in the wild',
+  },
+  'site-declares-vulnerable-runtime': {
+    sev: 'high', evidence: 'advisory', cwe: 'CWE-1395',
+    text: 'The estate declares a runtime version with a published advisory against it',
+    impact: 'The estate runs a runtime version a published advisory affects',
+    remedy: "Upgrade the runtime to a fixed version, or apply the vendor's fix for the named advisory",
+  },
+  'build-pins-vulnerable-component': {
+    sev: 'high', evidence: 'advisory', cwe: 'CWE-1395',
+    text: 'The build pins a component version with a published advisory against it',
+    impact: 'The build pins a component version a published advisory affects',
+    remedy: 'Upgrade the pinned component to a fixed version, or pin one no listed advisory affects',
+  },
+  'build-pins-exploited-component': {
+    sev: 'crit', evidence: 'advisory', cwe: 'CWE-1395',
+    text: 'The build pins a component version with a vulnerability CISA lists as known to be exploited',
+    impact: 'The pinned component has a vulnerability CISA lists as known to be exploited',
+    remedy: 'Upgrade the pinned component to a fixed version now; this one is being exploited in the wild',
+  },
+};
+
+// A compiler turns the source into what runs; a component is something the estate talks to the
+// mainframe through. The advisory arithmetic is the same, the person who acts on it is not.
+const COMPILERS = new Set(['gnucobol', 'opentext-cobol', 'ibm-enterprise-cobol']);
+
+// Files that decide what the build runs. A repository states this in one of a small number of
+// conventional places, and reading only those keeps the rule from matching prose in a README.
+function isBuildFile(path) {
+  const name = basename(path);
+  const p = path.replace(/\\/g, '/').toLowerCase();
+  if (/^(dockerfile|containerfile)(\..+)?$/i.test(name)) return true;
+  if (/^(gnu)?makefile$/i.test(name) || /\.mk$/i.test(name)) return true;
+  if (/^(\.tool-versions|\.gnucobol-version|\.cobc-version)$/i.test(name)) return true;
+  if (/^(jenkinsfile|azure-pipelines\.ya?ml|\.gitlab-ci\.ya?ml|docker-compose\.ya?ml)$/i.test(name)) return true;
+  if (p.includes('/.github/workflows/') && /\.ya?ml$/i.test(name)) return true;
+  if (/\.(sh|bash)$/i.test(name)) return true;
+  // Where the off-mainframe half of the estate is pinned: the driver, gateway and tooling a COBOL
+  // repository talks to the mainframe through.
+  if (/^(package\.json|pom\.xml)$/i.test(name) || /^build\.gradle(\.kts)?$/i.test(name)) return true;
+  return false;
+}
+
+// How a pinned version is written. Each pattern names the product, so a version number on its own
+// is never a finding: this rule reports what the build pins, not every number in a Makefile.
+const PINS = [
+  // ARG GNUCOBOL_VERSION=3.2  /  gnucobol-version: 3.2  /  apt-get install gnucobol=3.2
+  { product: 'gnucobol', re: /gnucobol[-_ ]?(?:version)?\s*[:=]+\s*["']?v?(\d+(?:\.\d+)+)/gi },
+  // gnucobol-3.2.tar.gz, gnucobol_3.2_amd64.deb
+  { product: 'gnucobol', re: /gnucobol[-_](\d+(?:\.\d+)+)[._-]/gi },
+  // FROM ghcr.io/example/gnucobol:3.2
+  { product: 'gnucobol', re: /from\s+\S*gnucobol\S*:v?(\d+(?:\.\d+)+)/gi },
+  // .tool-versions: "gnucobol 3.2"
+  { product: 'gnucobol', re: /^gnucobol\s+v?(\d+(?:\.\d+)+)\s*$/gim },
+
+  // The OpenText line shares one version across Visual COBOL, COBOL Server, Enterprise Developer
+  // and Enterprise Server, which is why an advisory against one names all of them.
+  { product: 'opentext-cobol', re: /(?:visual[-_ ]?cobol|cobol[-_ ]?server|enterprise[-_ ](?:server|developer|test[-_ ]server))[-_ ]?(?:version)?\s*[:=]+\s*["']?v?(\d+(?:\.\d+)+)/gi },
+  { product: 'opentext-cobol', re: /from\s+\S*(?:microfocus|opentext)\S*:v?(\d+(?:\.\d+)+)/gi },
+
+  // "@zowe/cli": "^7.18.0" in package.json, or a CLI version pinned in a pipeline.
+  { product: 'zowe', re: /"@zowe\/[\w-]+"\s*:\s*"[^\d"]*(\d+(?:\.\d+)+)/g },
+  { product: 'zowe', re: /zowe[-_ ]?cli[-_ ]?(?:version)?\s*[:=]+\s*["']?v?(\d+(?:\.\d+)+)/gi },
+
+  // ctgclient.jar is the gateway's client; Maven and Gradle name it beside its version.
+  { product: 'cics-transaction-gateway', re: /ctgclient[-_](\d+(?:\.\d+)+)\.jar/gi },
+  { product: 'cics-transaction-gateway', re: /com\.ibm\.ctg[\s\S]{0,200}?<version>\s*v?(\d+(?:\.\d+)+)/gi },
+  { product: 'cics-transaction-gateway', re: /com\.ibm\.ctg:[\w-]+:v?(\d+(?:\.\d+)+)/gi },
+  { product: 'cics-transaction-gateway', re: /from\s+\S*cics[-_]?transaction[-_]?gateway\S*:v?(\d+(?:\.\d+)+)/gi },
+];
+
+function withMavenProperties(src) {
+  const block = src.match(/<properties>([\s\S]*?)<\/properties>/i);
+  if (!block) return src;
+  const props = new Map();
+  for (const m of block[1].matchAll(/<([\w.-]+)>\s*([^<\s][^<]*?)\s*<\/\1>/g)) props.set(m[1], m[2]);
+  return src.replace(/\$\{([\w.-]+)\}/g, (all, name) => (props.has(name) ? props.get(name) : all));
+}
+
+// A customer feed's rows are named as the customer's, never as published: their source is an
+// extract nobody else can check.
+const relatedOf = (a) => (a.feed ? { id: a.id, feed: a.feed.extract } : { id: a.id, url: a.source.url });
+function fromFeeds(hits) {
+  const byFeed = new Map();
+  for (const a of hits) if (a.feed) { const k = `${a.feed.extract}, retrieved ${a.feed.retrieved}`; byFeed.set(k, [...(byFeed.get(k) || []), a.id]); }
+  return [...byFeed].map(([k, ids]) => `; ${ids.sort(byText).join(', ')} ${ids.length === 1 ? 'is' : 'are'} from the customer feed ${k}`).join('');
+}
+// "Published" only when every advisory is: a customer extract is not.
+const countOf = (hits) => { const p = hits.some((a) => a.feed) ? '' : 'published '; return hits.length === 1 ? (p ? 'has a published advisory' : 'has an advisory') : `has ${hits.length} ${p}advisories`; };
+const feedSummary = (f) => ({ file: f.file, extract: f.extract, retrieved: f.retrieved, loaded: f.advisories.length, refused: f.refused.length, ...(f.problem ? { problem: f.problem } : {}) });
+// What each loaded feed says it covered, after what the published record covers.
+function withFeeds(coverage, feeds) {
+  const out = { ...coverage };
+  for (const f of feeds) {
+    if (f.problem) continue;
+    const products = new Set([...Object.keys(f.coverage), ...f.advisories.map((a) => a.product)]);
+    for (const p of products) {
+      const said = f.coverage[p] || `${f.advisories.filter((a) => a.product === p).length} advisories`;
+      out[p] = `${out[p] ? `${out[p]}; ` : ''}customer feed ${f.extract}, retrieved ${f.retrieved}: ${said}`;
+    }
+  }
+  return out;
+}
+
+export function scanBuild(root, opts = {}) {
+  const site = loadSite(root, opts.site || null);
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(inScope(opts)).filter(isBuildFile);
+  const findings = [];
+  const age = kevAge();
+  const feeds = advisoryFeedPaths(opts).map((p) => loadAdvisoryFeed(p, { root }));
+  const extra = feeds.flatMap((f) => f.advisories);
+  const stats = {
+    filesScanned: 0, filesUnreadable: 0, pinsFound: 0,
+    kevCatalogVersion: age.catalogVersion, kevAgeDays: age.days, kevStale: age.stale,
+    // Which products this scan could have found anything for. A clean result over a product
+    // nobody has searched advisories for is not a clean result.
+    advisoryCoverage: withFeeds(COVERAGE, feeds),
+    ...(feeds.length ? { advisoryFeeds: feeds.map(feedSummary) } : {}),
+    runtimesDeclared: Object.keys(site.runtimeVersions || {}).length,
+    // CICS and Db2 are not pinned in a build file - they are what the code runs on, not what
+    // compiles it - so an advisory against them can only be acted on once the estate says which
+    // version it runs. Without that declaration these advisories are inert, and the summary says
+    // so rather than letting an empty result read as a clean one.
+    runtimesNotDeclared: ['cics-ts', 'db2-zos', 'ibm-enterprise-cobol']
+      .filter((p) => !(site.runtimeVersions || {})[p]),
+  };
+
+  // A feed asked for and not loaded, or a row the gate refused, is an advisory this scan was told to
+  // check and did not.
+  const notLoaded = feeds.flatMap((f) => (f.problem ? [`the advisory feed ${f.file} ${f.problem}`]
+    : f.refused.length ? [`the advisory feed ${f.file} (${f.extract}) had ${f.refused.length} of ${f.refused.length + f.advisories.length} rows refused by the advisory gate, the first ${f.refused[0].id || 'unnamed'}: ${f.refused[0].problems[0]}`] : []));
+  if (notLoaded.length) { stats.setIncomplete = true; stats.notLooked = notLoaded; }
+
+  // What the estate says it runs, checked against the same advisory table the build pins are.
+  for (const [product, version] of Object.entries(site.runtimeVersions || {})) {
+    const hits = advisoriesFor(product, String(version), extra);
+    if (!hits.length) continue;
+    const ids = hits.map((a) => a.id).sort(byText);
+    const exploited = ids.filter(isKnownExploited);
+    findings.push({
+      rule: 'site-declares-vulnerable-runtime', path: site.path ? 'cobolwork.site.json' : '(site configuration)', line: 1,
+      detail: `the estate declares ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}`,
+      related: hits.map(relatedOf),
+      sev: exploited.length ? 'crit' : undefined,
+      ...(exploited.length ? { knownExploited: exploited } : {}),
+    });
+  }
+
+  // Build files are small and few, so this set is the least likely of the nine to exhaust a heap.
+  // It walks inside the guard anyway: the budget is a property of the scan, not of one rule set's
+  // opinion of its own appetite, and a set that opts out is a set nobody notices has opted out.
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    // Maven states a version as a property more often than inline, and the pin is what it resolves
+    // to. Substituting in place keeps every line where it was.
+    if (/pom\.xml$/i.test(path)) src = withMavenProperties(src);
+    const lines = src.split(/\r?\n/);
+
+    const seen = new Set();
+    for (const { product, re } of PINS) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(src)) !== null) {
+        const version = m[1];
+        const key = product + '@' + version;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        stats.pinsFound++;
+
+        const hits = advisoriesFor(product, version, extra);
+        if (!hits.length) continue;
+
+        // A pin written across lines, as Maven writes one, is reported at its version.
+        const needle = m[0].includes('\n') ? m[0].split('\n').pop().trim() : m[0];
+        const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
+        const exploited = hits.filter((a) => isKnownExploited(a.id));
+        const ids = hits.map((a) => a.id).sort(byText);
+
+        const kind = COMPILERS.has(product) ? 'compiler' : 'component';
+        if (exploited.length) {
+          findings.push({
+            rule: `build-pins-exploited-${kind}`, path, line,
+            detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
+            related: hits.map(relatedOf),
+            knownExploited: exploited.map((a) => a.id).sort(byText),
+          });
+        } else {
+          findings.push({
+            rule: `build-pins-vulnerable-${kind}`, path, line,
+            detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
+              (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
+            related: hits.map(relatedOf),
+          });
+        }
+      }
+    }
+    return src.length;
+  }, { label: 'build', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  return report('build', { rules: BUILD_RULES, findings, stats, run });
+}

package/lib/sets/cics.mjs

@@ -0,0 +1,306 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { inScope, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
+import { dirname, join } from 'node:path';
+import { parseSource } from '../parser.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { buildControl, hasFact } from '../control.mjs';
+import { parseCsd } from '../csd.mjs';
+
+
+// `impact` says who can do what once the construct is present, so a reader can tell a defect they
+// must act on from one that only wants a look; `remedy` is the standard fix, the same for every
+// instance. Both ride with every finding of the rule (as ruleImpact/ruleRemedy).
+export const CICS_RULES = {
+  'cics-commarea-without-length-check': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-1284',
+    text: 'A program reads its communication area without checking EIBCALEN',
+    impact: 'A caller that passes no communication area, or a shorter one than the program reads, makes it read the storage past the area - and a transaction a terminal starts carries none',
+    remedy: 'Test EIBCALEN before reading DFHCOMMAREA, and return when it is zero or shorter than the record the program expects',
+  },
+  'cics-transfer-to-variable-program': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-470',
+    text: 'CICS transfers control to a program named by a variable',
+    impact: 'Whoever controls the value the program name is read from chooses which program the region runs next',
+    remedy: 'Transfer only to a name chosen from a fixed table of literals, never one taken from input, a record or the communication area',
+  },
+  'cics-commarea-length-exceeds-area': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-805',
+    text: 'A CICS call passes a length longer than the area it passes',
+    impact: 'The call reads past the passed area into the storage beside it on every invocation',
+    remedy: 'Pass a LENGTH no greater than the passed area, or LENGTH OF that area',
+  },
+  'cics-commarea-length-exceeds-callee': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-805',
+    text: 'A CICS call passes a length longer than the callee declares',
+    impact: 'The callee reads past what the caller passed, into unrelated storage, on every call',
+    remedy: "Pass a LENGTH no greater than the callee's declared communication area",
+  },
+  // A program that checks a password itself sends a successful sign-on somewhere. Another route to
+  // the same place that does not pass the check - a PF key the sign-on screen does not expect, a
+  // missing communication area - is a way in without a password (NetSPI, "Conquering CICS", way 6).
+  // Which comparison is the sign-on is read from field names containing PWD, PSWD or PASSW, which is
+  // a heuristic, and a sign-on that only sets a flag for a later test is not followed.
+  'cics-signon-says-which-half-failed': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-204',
+    text: 'A sign-on answers a bad user and a bad password differently',
+    impact: 'The two failures carry different messages, so anyone can try a name and learn from the reply whether it exists - which turns guessing a password on one account into collecting the list of accounts first',
+    remedy: 'Answer both failures with the same message and the same timing, as the programs that get this right do: one "Incorrect username or password" for either',
+  },
+  'cics-signon-bypassed': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-288',
+    text: 'A route reaches the program a sign-on grants without passing the password check',
+    impact: 'An entry the sign-on screen does not expect - an AID key it does not handle, a missing communication area - reaches the guarded program without the comparison, so it runs without a password',
+    remedy: 'Reach the granted program only from the path where the password comparison succeeded; on any other entry, re-drive the sign-on',
+  },
+};
+
+const PASSWORD = /PWD|PSWD|PASSW|PASSCODE|PASSPHRASE/;
+// A message that says a sign-on failed. Which half it names is the whole question: a reply that
+// distinguishes "no such user" from "wrong password" answers the attacker's first question for them.
+const FAILED = /(not found|invalid|incorrect|unknown|wrong|does not exist|not match|mismatch|no such)/i;
+// Which half the message names, by the words in it rather than by a regex: a word-boundary escape
+// written into this file became a literal backspace byte once, and the regex then matched nothing.
+const wordsOf = (text) => String(text).toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+const NAMES_USER = new Set(['user', 'userid', 'username', 'logon', 'signon']);
+const NAMES_PASSWORD = new Set(['password', 'passwd', 'pwd', 'passcode', 'passphrase']);
+const names = (set) => (text) => wordsOf(text).some((w) => set.has(w));
+const namesUser = names(NAMES_USER);
+const namesPassword = names(NAMES_PASSWORD);
+export function tellsWhichHalfFailed(literals) {
+  const failures = [...new Set(literals.map((l) => String(l).trim()))].filter((l) => l.length >= 6 && FAILED.test(l));
+  const user = failures.filter((l) => namesUser(l) && !namesPassword(l));
+  const password = failures.filter((l) => namesPassword(l) && !namesUser(l));
+  if (!user.length || !password.length) return null;
+  return { user: user[0], password: password[0] };
+}
+const FIGURATIVE = /^(SPACES?|ZEROS?|ZEROES|LOW-VALUES?|HIGH-VALUES?|QUOTES?|NULLS?)$/;
+const RELOPS = new Set(['=', '<>']);
+// A test that compares one password-named field with another field, which is what checking a password
+// looks like: equal on one outcome, not equal on the other. A comparison with a literal or SPACES
+// checks that one was typed, not that it is right.
+export function signOnTest(test) {
+  const toks = test.cond || (test.evaluate && test.evaluate.subjects.length === 1 && test.evaluate.subjects[0].u === 'TRUE' && test.evaluate.conds.length === 1 ? test.evaluate.conds[0] : null);
+  if (!toks) return null;
+  const at = toks.findIndex((t) => (t.t === 'op' && RELOPS.has(t.v)) || (t.t === 'word' && (t.u === 'EQUAL' || t.u === 'EQUALS')));
+  if (at < 0 || toks.some((t) => t.t === 'word' && (t.u === 'AND' || t.u === 'OR'))) return null;
+  const names = (side) => side.filter((t) => t.t === 'word' && !['NOT', 'IS', 'TO', 'OF', 'IN', 'EQUAL', 'EQUALS', 'FUNCTION', 'UPPER-CASE', 'LOWER-CASE', 'TRIM'].includes(t.u));
+  const left = toks.slice(0, at), right = toks.slice(at + 1);
+  const l = names(left), r = names(right);
+  if (!l.length || !r.length || [...left, ...right].some((t) => t.t === 'lit' || t.t === 'num') || [...l, ...r].some((t) => FIGURATIVE.test(t.u))) return null;
+  if (![...l, ...r].some((t) => PASSWORD.test(t.u))) return null;
+  const negated = (toks[at].t === 'op' && toks[at].v === '<>') || left.some((t) => t.t === 'word' && t.u === 'NOT');
+  return negated ? { false: 'SIGNON' } : { true: 'SIGNON' };
+}
+
+
+function execOptions(exec) {
+  const opts = new Map();
+  const words = [];
+  const toks = exec.toks;
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if (t.t !== 'word') continue;
+    words.push(t.u);
+    if (toks[i + 1] && toks[i + 1].t === 'sep' && toks[i + 1].v === '(') {
+      const inner = [];
+      let depth = 1;
+      for (let k = i + 2; k < toks.length && depth > 0; k++) {
+        if (toks[k].t === 'sep') { depth += toks[k].v === '(' ? 1 : -1; if (depth === 0) break; continue; }
+        inner.push(toks[k]);
+      }
+      if (!opts.has(t.u)) opts.set(t.u, inner);
+    }
+  }
+  return { opts, words };
+}
+
+const subtreeRead = (x) => x.directRefs > 0 || x.children.some(subtreeRead);
+
+// Sizes come from the parser's data-division layout, which is graded against the compiler, so a
+// length compared here is the length the compiler would compute.
+//
+// Everything this rule set needs from one program is taken while its parse tree is in hand, and the
+// tree is then released. Holding every tree until the end is what the flow engine was refactored
+// away from, and this set kept doing it: on a 100,000-program repository it exhausted an 8 GB heap
+// and took a corpus run with it. What survives per program is an identifier, a communication area's
+// size, one boolean, and a short list of transfers.
+export function scanCics(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(isProgram).filter(inScope(opts));
+  // Identifier to the size of that program's DFHCOMMAREA, which is all a caller needs of a callee.
+  const commareaSize = new Map();
+  const summaries = [];
+  const findings = [];
+  const stats = { filesScanned: 0, cicsPrograms: 0, withCommarea: 0, commareaRead: 0, filesUnreadable: 0 };
+  // Where a statement really is. One that came from a copybook carries the copybook's path and
+  // line; reporting it at the program's path with the copybook's line points at an unrelated line.
+  const where = (x, path) => ({ path: x.file ? relPath(root, x.file) : path, line: x.line || 1 });
+
+  // The whole of what the second pass reads, computed once, while the tree is still here.
+  function summarise(p, path) {
+    const isSignOn = [...new Set([...p.refs.map(x => x.tok.u), ...p.execs.flatMap(e => e.toks.filter(t => t.t === 'word').map(t => t.u))])].some((w) => PASSWORD.test(w));
+    const words = new Set([...p.refs.map(x => x.tok.u), ...p.execs.flatMap(e => e.toks.filter(t => t.t === 'word').map(t => t.u))]);
+    const commarea = p.items.find(i => i.name === 'DFHCOMMAREA' && i.section === 'LINKAGE');
+    // A variable naming the program usually holds one literal from its VALUE clause.
+    const valueOf = (name) => {
+      const it = p.items.find(i => i.name === name);
+      const lit = it && it.values && it.values.find(v => v.t === 'lit');
+      return lit ? String(lit.v).trim().toUpperCase() : null;
+    };
+    const transfers = [];
+    for (const e of p.execs) {
+      if (e.kind !== 'CICS') continue;
+      const { opts: o, words: w } = execOptions(e);
+      const verb = w[0];
+      if (!['LINK', 'XCTL', 'START'].includes(verb)) continue;
+      const pgm = (o.get('PROGRAM') || o.get('TRANSID') || [])[0];
+      const areaTok = (o.get('COMMAREA') || o.get('FROM') || [])[0];
+      const lenTok = (o.get('LENGTH') || [])[0];
+      const declared = lenTok && (lenTok.t === 'num' || /^\d+$/.test(lenTok.v)) ? Number(lenTok.v) : null;
+      const area = areaTok ? p.items.find(i => i.name === areaTok.u) : null;
+      const variableProgram = pgm && pgm.t === 'word' ? pgm.u : null;
+      transfers.push({
+        at: where(e, path), verb,
+        variableProgram,
+        calleeName: pgm && pgm.t === 'lit' ? String(pgm.v).trim().toUpperCase() : null,
+        callee: pgm && pgm.t === 'lit' ? String(pgm.v).trim().toUpperCase() : variableProgram ? valueOf(variableProgram) : null,
+        areaName: areaTok ? areaTok.u : null,
+        areaSize: area && area.size ? area.size : null,
+        declared,
+      });
+    }
+    // A program that points DFHCOMMAREA at storage of its own is not reading a caller's area.
+    const tokens = (p.proc && p.proc.tokens) || [];
+    const pointsItself = (p.statements || []).some((st) => {
+      if (st.verb !== 'SET') return false;
+      const w = tokens.slice(st.at + 1, st.end).filter((t) => t.t === 'word').map((t) => t.u);
+      return w.some((x, k) => x === 'ADDRESS' && w[k + 1] === 'OF' && w[k + 2] === 'DFHCOMMAREA');
+    });
+    return {
+      id: p.id, path,
+      ownCics: p.execs.some((e) => e.kind === 'CICS'),
+      pointsItself,
+      commarea: commarea ? { ...where(commarea, path), size: commarea.size, read: subtreeRead(commarea) } : null,
+      checksLength: words.has('EIBCALEN'),
+      transfers,
+      signOnBypasses: isSignOn ? signOnBypasses(p, path) : [],
+      // Gated the same way: a program with no password-named field is not answering a sign-on,
+      // and 'User not found' in a lookup screen is not telling anyone which accounts exist.
+      tellsWhichHalf: isSignOn ? tellsWhichHalfFailed((p.statements || []).flatMap((st) => (st.literals || []).map((l) => (l && l.v !== undefined ? l.v : l)))) : null,
+      lineOf: (text) => { const st = (p.statements || []).find((x) => (x.literals || []).some((l) => String(l && l.v !== undefined ? l.v : l).trim() === text)); return (st && st.line) || 1; },
+    };
+  }
+
+  // Where a program sends control after its sign-on succeeds, and every other route there.
+  function signOnBypasses(p, path) {
+    let ctl;
+    const byName = new Map();
+    for (const it of p.items) if (!byName.has(it.name)) byName.set(it.name, it);
+    const resolve = (tok) => (tok && tok.t === 'word' ? p.resolved.get(tok) || byName.get(tok.u) || null : null);
+    try { ctl = buildControl(p, resolve, { extra: signOnTest }); } catch { return []; }
+    const bit = ctl.extraFacts && ctl.extraFacts.get('SIGNON');
+    if (bit == null) return [];
+    const sends = [];
+    for (const e of p.execs) {
+      if (e.kind !== 'CICS') continue;
+      const { opts: o, words: w } = execOptions(e);
+      const opt = w[0] === 'XCTL' || w[0] === 'LINK' ? 'PROGRAM' : (w[0] === 'RETURN' || w[0] === 'START') ? 'TRANSID' : null;
+      const t = opt && (o.get(opt) || [])[0];
+      if (!t || t.t !== 'lit') continue;
+      const target = `${opt === 'PROGRAM' ? '' : 'transaction '}${String(t.v).trim().toUpperCase()}`;
+      if (target === p.id) continue;
+      const bits = ctl.facts.get(ctl.nodeOf.get(e));
+      if (!bits) continue;
+      sends.push({ e, verb: w[0], target, signedOn: hasFact(bits, bit) });
+    }
+    const granted = new Set(sends.filter((x) => x.signedOn).map((x) => x.target));
+    const aid = p.refs.some((r) => r.tok.u === 'EIBAID');
+    return sends.filter((x) => !x.signedOn && granted.has(x.target)).map((x) => ({
+      ...where(x.e, path),
+      detail: `${p.id} runs EXEC CICS ${x.verb} to ${x.target} on a route that does not pass its password check, and ${x.target} is where a successful sign-on goes${aid ? '; the program dispatches on EIBAID, so a key the sign-on screen does not expect may take this route' : ''}`,
+    }));
+  }
+
+  // Releasing each tree bounds what one program costs; it does not bound what a hundred thousand of
+  // them cost together. The shared loop watches the heap and stops before V8 cannot collect, and
+  // names every file it did not reach.
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    if (!/EXEC\s+CICS/i.test(src) && !/(?:^|[\s.])COPY\s+/i.test(src)) return src.length;
+    let r;
+    try {
+      r = tree.parse(f, src);
+    } catch (e) { noteUnparsed(stats, tree, f, e); return src.length; }
+    if (!r.programs.some(p => p.execs.some(e => e.kind === 'CICS'))) return src.length;
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const p of r.programs) {
+      const sum = summarise(p, path);
+      summaries.push(sum);
+      if (p.id && !commareaSize.has(p.id)) commareaSize.set(p.id, sum.commarea ? sum.commarea.size : null);
+    }
+    r = null;                       // the tree is not needed past this point
+    return src.length;
+  }, { label: 'cics', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+
+  // What every caller in the tree passes each program, and which programs a transaction starts: a
+  // terminal starts a transaction with no communication area at all.
+  const callersOf = new Map();
+  for (const s of summaries) for (const t of s.transfers) {
+    if (t.verb === 'START' || !t.callee) continue;
+    if (!callersOf.has(t.callee)) callersOf.set(t.callee, []);
+    callersOf.get(t.callee).push(t.declared ?? t.areaSize ?? 0);
+  }
+  const startable = new Set();
+  for (const f of tree.list().filter((p) => /\.csd$/i.test(p)).filter(inScope(opts))) {
+    try { for (const t of parseCsd(tree.text(f).text).transactions.values()) if (t.program) startable.add(String(t.program).toUpperCase()); } catch { /* unreadable: nothing is known to start from it */ }
+  }
+
+  const reported = new Set();
+  for (const s of summaries) {
+    stats.cicsPrograms++;
+    if (s.commarea) stats.withCommarea++;
+    if (s.commarea && s.commarea.read) {
+      stats.commareaRead++;
+      // A zero-length area is a parse that read a program as a copybook, and a program with no
+      // EXEC CICS of its own, or one that points DFHCOMMAREA at storage itself, has no caller's area.
+      const key = `${s.commarea.path}|${s.commarea.line}|${s.id}`;
+      if (!s.checksLength && s.ownCics && !s.pointsItself && s.commarea.size > 0 && !reported.has(key)) {
+        reported.add(key);
+        const callers = callersOf.get(String(s.id || '').toUpperCase()) || [];
+        const covered = callers.length > 0 && callers.every((n) => n >= s.commarea.size) && !startable.has(String(s.id || '').toUpperCase());
+        findings.push({
+          rule: 'cics-commarea-without-length-check', path: s.commarea.path, line: s.commarea.line, program: s.id,
+          ...(covered ? { sev: 'low' } : {}),
+          detail: `${s.id} reads DFHCOMMAREA (${s.commarea.size} bytes declared) and never references EIBCALEN, so a shorter or absent communication area is read as if it were whole${covered ? `; every caller in the tree passes at least ${s.commarea.size} bytes, and no transaction starts it` : ''}`,
+        });
+      }
+    }
+    for (const b of s.signOnBypasses) findings.push({ rule: 'cics-signon-bypassed', path: b.path, line: b.line, program: s.id, detail: b.detail });
+    if (s.tellsWhichHalf) {
+      findings.push({
+        rule: 'cics-signon-says-which-half-failed', path: s.path, line: s.lineOf(s.tellsWhichHalf.user), program: s.id,
+        detail: `${s.id} answers a bad user with '${s.tellsWhichHalf.user}' and a bad password with '${s.tellsWhichHalf.password}', so the reply says which of the two was wrong`,
+      });
+    }
+    for (const t of s.transfers) {
+      if (t.variableProgram) {
+        findings.push({ rule: 'cics-transfer-to-variable-program', ...t.at, program: s.id, detail: `${s.id} runs EXEC CICS ${t.verb} with the program name taken from ${t.variableProgram}` });
+      }
+      if (t.declared == null || !t.areaName) continue;
+      if (t.areaSize && t.declared > t.areaSize) {
+        findings.push({ rule: 'cics-commarea-length-exceeds-area', ...t.at, program: s.id, detail: `${s.id} passes LENGTH(${t.declared}) with ${t.areaName}, which is ${t.areaSize} bytes` });
+      }
+      const targetSize = t.calleeName ? commareaSize.get(t.calleeName) : undefined;
+      if (targetSize && t.declared > targetSize) {
+        findings.push({ rule: 'cics-commarea-length-exceeds-callee', ...t.at, program: s.id, detail: `${s.id} passes LENGTH(${t.declared}) to ${t.calleeName}, whose DFHCOMMAREA is ${targetSize} bytes` });
+      }
+    }
+  }
+
+  return report('cics', { rules: CICS_RULES, findings, stats, run });
+}