@portll/cobolwork 0.2.75 → 0.2.117

package/lib/consequence.mjs

@@ -40,6 +40,13 @@ const SINK_CLASSES = {
   'arithmetic': [],
   'record-key': [],
   'log': [],
+  'storage-length': [],
+  'xml-document': [],
+  'connection-target': [],
+  'screen': [],
+  'cics-sysid': [],
+  // A system-programming command acts with the region's authority on whatever resource it names.
+  'cics-system-resource': [ESCALATES],
 };
 
 // Past a table or a reference with SSRANGE abending, a bad index stops the program instead of
@@ -50,6 +57,11 @@ const RULE_CLASSES = {
   // A variable names the program, and nothing says input reaches it: over the 500-repository corpus
   // every one read held a literal. Input that does reach it is *-to-cics-dynamic-transfer.
   'cics-transfer-to-variable-program': [],
+  // A failure carried on from: what follows depends on the program, and severity decides.
+  'cics-condition-ignored': [],
+  // Disclosure of stored secrets and a weaker check; severity decides.
+  'program-checks-stored-password': [],
+  'password-case-folded-before-compare': [],
   'cics-signon-bypassed': [ESCALATES],
   'csd-defines-diagnostic-transaction': [ESCALATES],
   'csd-transaction-without-command-security': [ESCALATES],
@@ -59,6 +71,12 @@ const RULE_CLASSES = {
   'jcl-instream-credential': [ESCALATES],
   'web-uri-carries-a-credential': [ESCALATES],
   'log-writes-a-credential': [ESCALATES],
+  'zowe-config-secret-in-clear': [ESCALATES],
+  'zowe-mcp-password-in-config': [ESCALATES],
+  'zowe-mock-credentials': [ESCALATES],
+  // An agent at the full tier submits jobs and runs commands as the user it logs on as.
+  'zowe-mcp-tier-full': [ESCALATES],
+  'zowe-mcp-tier-writes': [MUTATES],
   // A crafted source file compiled by an affected cobc runs in the build, with the build's authority.
   'build-pins-vulnerable-compiler': [ESCALATES],
   'build-pins-exploited-compiler': [ESCALATES],
@@ -87,8 +105,19 @@ const RULE_CLASSES = {
   'web-link-opens-without-noopener': [],
   'cics-listener-accepts-cleartext': [],
   'compile-undefined-name': [],
+  // A value the generated code gets wrong with no input driving it; severity decides.
+  'binary-store-exceeds-picture-under-trunc-opt': [],
+  'intermediate-result-loses-high-order-digits': [],
+  'character-range-reverses-in-ascii': [],
   'log-writes-personal-data': [],
   'display-echoes-a-credential': [],
+  'control-cards-from-dataset': [],
+  'sort-exit-named': [],
+  'tso-batch-runs-program': [],
+  'zowe-config-tls-verify-off': [],
+  'zowe-config-cleartext': [],
+  'zowe-mcp-data-marking-off': [],
+  'zowe-mcp-unpinned': [],
 };
 
 // Coverage and context assert no defect, so they carry no consequence.