@portll/cobolwork 0.2.76 → 0.2.117

package/lib/reach.mjs

@@ -10,9 +10,8 @@
 // effect is unstated, and the scan says so rather than ranking anything. See docs/spec/reach.md.
 //
 // Both are annotations, not re-rankings: severity is urgency, reach is who can drive it, effect is
-// what driving it runs as. Three axes a consumer combines, kept apart so each names the fact that
-// moved it. Neither ever becomes "exploitable" - that word needs a witness on the running system,
-// which is not what reading source and records produces.
+// what driving it runs as. Three axes kept apart so each names the fact that moved it;
+// lib/exploitability.mjs joins them with the route into a verdict.
 import { readFileSync, realpathSync } from 'node:fs';
 import { basename, sep, delimiter } from 'node:path';
 
@@ -82,24 +81,42 @@ export function reachResolver({ feeds = [], site = {} } = {}) {
     return null;
   };
   const privilegedOf = (kind, name) => (kind === 'transaction' ? privTx.has(up(name)) : kind === 'job' ? privJob.has(up(name)) : false);
-  return { declared, effectDeclared, accessOf, privilegedOf };
+  // Which record said so, for a verdict to cite: the feed with its extract and date, or the site file.
+  const siteName = site.path ? basename(site.path) : 'the site file';
+  const cite = (f) => `${f.file} (${f.extract}, retrieved ${f.retrieved})`;
+  const accessFrom = (kind, name) => {
+    const f = good.find((x) => x[`${kind}s`][up(name)]);
+    return f ? cite(f) : accessOf(kind, name) ? siteName : null;
+  };
+  const privilegedFrom = (kind, name) => {
+    const f = good.find((x) => x.privileged[`${kind}s`].includes(up(name)));
+    return f ? cite(f) : privilegedOf(kind, name) ? siteName : null;
+  };
+  return { declared, effectDeclared, accessOf, privilegedOf, accessFrom, privilegedFrom };
 }
 
+export const entryKind = (e) => (e.transaction ? 'transaction' : e.job !== undefined ? 'job' : null);
+const entryKey = (e) => (e.transaction ? e.transaction : e.job || '');
+export const entryName = (e) => (e.transaction
+  ? `transaction ${e.transaction}${e.urimap ? ` through URIMAP ${e.urimap}${e.uri ? ` (${e.uri})` : ''}` : ''}`
+  : `job ${e.job || '?'} step ${e.step || '(unnamed)'}`);
+
 // The access of one startedBy entry, whichever kind it is.
-const accessOfEntry = (e, resolver) => (e.transaction ? resolver.accessOf('transaction', e.transaction) : (e.job !== undefined ? resolver.accessOf('job', e.job || '') : null));
+export const accessOfEntry = (e, resolver) => (entryKind(e) ? resolver.accessOf(entryKind(e), entryKey(e)) : null);
+export const accessFromEntry = (e, resolver) => (entryKind(e) ? resolver.accessFrom(entryKind(e), entryKey(e)) : null);
+export const privilegedFromEntry = (e, resolver) => (entryKind(e) ? resolver.privilegedFrom(entryKind(e), entryKey(e)) : null);
 
 // Stamp `reach` on every finding an entry point reaches, and count the three ways. `open` if any
-// entry that reaches it is open, `restricted` if every entry that resolves is restricted and none
-// is open, `undeclared` if none of its entries is a declared fact. A finding no entry reaches
-// carries no reach - there is nothing to say.
+// entry that reaches it is open; `restricted` only if every entry is restricted and none went
+// unlisted, since an entry nobody declared may be open; otherwise `undeclared`. A finding no entry
+// reaches carries no reach - there is nothing to say.
 export function stampReach(findings, resolver) {
   const by = { open: 0, restricted: 0, undeclared: 0 };
   for (const f of findings) {
     const entries = f.startedBy || [];
     if (!entries.length) continue;
-    let open = false, restricted = false;
-    for (const e of entries) { const a = accessOfEntry(e, resolver); if (a === 'open') open = true; else if (a === 'restricted') restricted = true; }
-    f.reach = open ? 'open' : restricted ? 'restricted' : 'undeclared';
+    const access = entries.map((e) => accessOfEntry(e, resolver));
+    f.reach = access.includes('open') ? 'open' : !f.startedByMore && access.every((a) => a === 'restricted') ? 'restricted' : 'undeclared';
     by[f.reach]++;
   }
   return by;
@@ -113,7 +130,7 @@ export function stampEffect(findings, resolver) {
   for (const f of findings) {
     const entries = f.startedBy || [];
     if (!entries.length) continue;
-    if (entries.some((e) => (e.transaction ? resolver.privilegedOf('transaction', e.transaction) : (e.job !== undefined ? resolver.privilegedOf('job', e.job || '') : false)))) {
+    if (entries.some((e) => entryKind(e) && resolver.privilegedOf(entryKind(e), entryKey(e)))) {
       f.effect = 'privileged';
       by.privileged++;
     }

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"13889f659145667b2c02bd2c4b2f18092fd64071","tag":"v0.2.76"}
+{"commit":"b144074728e1b40f1c6a230b06f1a6b8b0758d51"}

package/lib/sarif.mjs

@@ -211,6 +211,7 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
             // Who can drive the finding and what it runs as, when the estate declared the facts.
             ...(f.reach ? { reach: f.reach } : {}),
             ...(f.effect ? { effect: f.effect } : {}),
+            ...(f.exploitability ? { exploitability: f.exploitability } : {}),
           } } : {}),
           locations: [{ physicalLocation: { artifactLocation: { uri: uriOf(f.path), uriBaseId: '%SRCROOT%' }, region: { startLine: f.line || 1 } } }],
           ...(f.related ? { relatedLocations: f.related.map((r) => ({ physicalLocation: { artifactLocation: { uri: uriOf(r.path), uriBaseId: '%SRCROOT%' }, region: { startLine: r.line || 1 } }, message: { text: textOf(r.detail) } })) } : {}),

package/lib/sbom.mjs

@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// A CycloneDX 1.6 bill of materials for a COBOL estate (docs/spec/evidence.md §11): every source
+// file by digest, what each program copies and calls, what each job runs, and the platforms a
+// program uses, without versions the source does not state.
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { basename, dirname, extname, resolve, sep } from 'node:path';
+import { parseSource, detectFormat } from './parser.mjs';
+import { parseJcl } from './jcl.mjs';
+import { optionCards } from './options.mjs';
+import { inScope, isBms, isCopybook, isJcl, isProgram, readSource, relPath } from './sources.mjs';
+import { TOOL_VERSION } from './version.mjs';
+import { treeFor } from './kernel/source-tree.mjs';
+
+// The namespace of cobolwork's version 5 UUIDs (RFC 4122 §4.3), fixed so a serial number repeats.
+const NAMESPACE = Buffer.from('6f1d2b8e5c3a4e7f9a0b1c2d3e4f5a6b', 'hex');
+
+function uuidv5(name) {
+  const h = createHash('sha1').update(NAMESPACE).update(name, 'utf8').digest().subarray(0, 16);
+  h[6] = (h[6] & 0x0f) | 0x50;
+  h[8] = (h[8] & 0x3f) | 0x80;
+  const x = h.toString('hex');
+  return `${x.slice(0, 8)}-${x.slice(8, 12)}-${x.slice(12, 16)}-${x.slice(16, 20)}-${x.slice(20)}`;
+}
+
+const sha256 = (b) => createHash('sha256').update(b).digest('hex');
+const order = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+
+function platformsOf(src, calls) {
+  const s = new Set();
+  if (/EXEC\s+CICS\b/i.test(src)) s.add('CICS');
+  if (/EXEC\s+SQL\b/i.test(src)) s.add('Db2');
+  if (/EXEC\s+DLI\b/i.test(src)) s.add('IMS');
+  for (const c of calls) {
+    if (c.kind !== 'L') continue;
+    const n = String(c.name).toUpperCase();
+    if (n === 'CBLTDLI' || n === 'AIBTDLI') s.add('IMS');
+    if (/^MQ[A-Z]{2,}$/.test(n)) s.add('MQ');
+    if (/^CEE[A-Z0-9]+$/.test(n)) s.add('Language Environment');
+  }
+  return [...s];
+}
+
+function kindOf(file, src) {
+  if (isProgram(file)) return /PROCEDURE\s+DIVISION|PROGRAM-ID/i.test(src) ? 'program' : 'copybook';
+  if (isCopybook(file)) return 'copybook';
+  if (isJcl(file)) return /^\/\/\S*\s+PROC\b/m.test(src) && !/^\/\/\S*\s+JOB\b/m.test(src) ? 'proc' : 'jcl';
+  if (isBms(file)) return 'bms';
+  const ext = extname(file).toLowerCase();
+  if (ext === '.csd') return 'csd';
+  if (ext === '.ddl' || ext === '.sql') return 'ddl';
+  return null;
+}
+
+export function sbom(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const idx = tree.index;
+  const top = resolve(root);
+  const within = (p) => resolve(p).startsWith(top + sep);
+  const refOf = (p) => (within(p) ? relPath(root, p) : `copylib:${basename(p)}`);
+
+  const entries = [];
+  const programIds = new Map();
+  for (const f of tree.list().filter(inScope(opts)).sort()) {
+    let bytes;
+    let src;
+    try { bytes = readFileSync(f); src = readSource(f).text; } catch { continue; }
+    const kind = kindOf(f, src);
+    if (!kind) continue;
+    const entry = { file: f, ref: relPath(root, f), bytes, src, kind };
+    if (kind === 'program') {
+      try {
+        const res = parseSource(src, f, { format: 'auto', includeDirs: idx.copyDirs, fileIndex: idx.index, mainDir: dirname(f), copyFormat: 'auto', systemDirs: opts.systemDirs || [] });
+        entry.programs = res.programs;
+        entry.copies = res.copies;
+        for (const p of res.programs) if (p.id) programIds.set(String(p.id).toUpperCase(), entry.ref);
+      } catch { entry.unparsed = true; }
+    } else if (kind === 'jcl' || kind === 'proc') {
+      try { entry.jcl = parseJcl(src, f); } catch { entry.unparsed = true; }
+    }
+    entries.push(entry);
+  }
+
+  const components = new Map();
+  const dependencies = new Map();
+  const depend = (from, to) => { if (!dependencies.has(from)) dependencies.set(from, new Set()); dependencies.get(from).add(to); };
+
+  for (const e of entries) {
+    const properties = [{ name: 'cobolwork:kind', value: e.kind }];
+    if (e.unparsed) properties.push({ name: 'cobolwork:unparsed', value: 'true' });
+    if (e.kind === 'program' && e.programs && e.programs.length) {
+      const ids = e.programs.map((p) => p.id).filter(Boolean);
+      if (ids.length) properties.push({ name: 'cobolwork:program-id', value: ids.join(',') });
+      properties.push({ name: 'cobolwork:format', value: detectFormat(e.src) });
+      const options = optionCards(e.src).flatMap((c) => c.options);
+      if (options.length) properties.push({ name: 'cobolwork:options', value: options.join(' ') });
+      for (const c of e.copies || []) {
+        if (c.status !== 'resolved' || !c.path) continue;
+        const ref = refOf(c.path);
+        depend(e.ref, ref);
+        if (!within(c.path) && !components.has(ref)) {
+          let b = null;
+          try { b = readFileSync(c.path); } catch { /* read at parse time, gone since */ }
+          components.set(ref, { 'bom-ref': ref, type: 'file', name: ref, ...(b ? { hashes: [{ alg: 'SHA-256', content: sha256(b) }] } : {}), properties: [{ name: 'cobolwork:kind', value: 'copybook' }, { name: 'cobolwork:source', value: 'copy library' }] });
+        }
+      }
+      const calls = e.programs.flatMap((p) => p.calls || []);
+      const unresolved = new Set();
+      for (const c of calls) {
+        if (c.kind !== 'L') { unresolved.add(String(c.name)); continue; }
+        const target = programIds.get(String(c.name).toUpperCase());
+        if (target && target !== e.ref) depend(e.ref, target);
+      }
+      if (unresolved.size) properties.push({ name: 'cobolwork:unresolved-call', value: [...unresolved].sort(order).join(',') });
+      for (const p of platformsOf(e.src, calls)) {
+        const ref = `platform:${p}`;
+        depend(e.ref, ref);
+        if (!components.has(ref)) components.set(ref, { 'bom-ref': ref, type: 'platform', name: p });
+      }
+    }
+    if (e.jcl) {
+      for (const step of e.jcl.steps || []) {
+        const target = step.pgm ? programIds.get(String(step.pgm).toUpperCase()) : null;
+        if (target) depend(e.ref, target);
+      }
+    }
+    components.set(e.ref, { 'bom-ref': e.ref, type: 'file', name: e.ref, hashes: [{ alg: 'SHA-256', content: sha256(e.bytes) }], properties });
+  }
+
+  const list = [...components.values()].sort((a, b) => order(a['bom-ref'], b['bom-ref']));
+  const digests = list.filter((c) => c.hashes).map((c) => c.hashes[0].content).sort(order);
+  const name = opts.name || basename(top);
+  const epoch = process.env.SOURCE_DATE_EPOCH;
+  return {
+    bomFormat: 'CycloneDX',
+    specVersion: '1.6',
+    serialNumber: `urn:uuid:${uuidv5(`${name}\n${digests.join('\n')}`)}`,
+    version: 1,
+    metadata: {
+      ...(epoch && /^\d+$/.test(epoch) ? { timestamp: new Date(Number(epoch) * 1000).toISOString() } : {}),
+      tools: { components: [{ type: 'application', name: 'cobolwork', version: TOOL_VERSION }] },
+      component: { 'bom-ref': `estate:${name}`, type: 'application', name },
+    },
+    components: list,
+    dependencies: [...dependencies.entries()].sort(([a], [b]) => order(a, b)).map(([ref, set]) => ({ ref, dependsOn: [...set].sort(order) })),
+  };
+}

package/lib/scan.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { join } from 'node:path';
-import { sortFindings, tally, evidenceMap, EVIDENCE } from './kernel/findings.mjs';
+import { sortFindings, tally, evidenceMap, EVIDENCE, EXPLOITABILITY } from './kernel/findings.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 import { REGISTRY, RULE_SETS, ALL_RULES, reportKey } from './kernel/registry.mjs';
 import { inventory } from './inventory.mjs';
@@ -12,6 +12,7 @@ import { printable } from './kernel/printable.mjs';
 import { rollup } from './sets/flow.mjs';
 import { loadSite } from './site.mjs';
 import { reachFeedPaths, loadReachFeed, reachResolver, stampReach, stampEffect } from './reach.mjs';
+import { stampExploitability, byVerdict, HANDLING, witnessFeedPaths, loadWitnessFeed, applyWitness } from './exploitability.mjs';
 
 import { FLOW_MODEL, SCHEMA_VERSION, TOOL_VERSION } from './version.mjs';
 
@@ -34,11 +35,46 @@ const underRepo = (repo, p) => (repo ? `${repo}/${p}` : p);
 // Frameworks that did not load; a reason can quote the unparsed file.
 const COMPLIANCE_UNLOADED = FRAMEWORKS_UNLOADED.map((f) => ({ id: f.id, why: printable(f.why) }));
 
+// The estate facts of several repositories' reports as one summary: counts add, feeds are the same
+// for every repository so the first names them, and a note says which repositories it covers.
+function mergeEstate(reports) {
+  const all = reports.map(({ repo, r }) => ({ repo, s: r.summary }));
+  const addUp = (k) => {
+    const have = all.filter((x) => x.s[k]);
+    if (!have.length) return null;
+    const out = {};
+    for (const { s } of have) for (const [f, n] of Object.entries(s[k])) out[f] = (out[f] || 0) + n;
+    return out;
+  };
+  const union = (k) => [...new Set(all.flatMap((x) => x.s[k] || []))];
+  const first = (k) => all.find((x) => x.s[k])?.s[k];
+  const without = (k) => all.filter((x) => x.s[k]).map((x) => x.repo);
+  const of = (names) => `${names.length} of ${all.length} repositories (${names.join(', ')})`;
+  const reachless = without('reachNote');
+  const effectless = without('effectNote');
+  const driven = all.filter((x) => x.s.reachNote).reduce((n, x) => n + (x.s.byExploitability?.['attacker-driven'] || 0), 0);
+  // A result is unmatched only where no repository's finding carries it.
+  const unmatchedIn = all.map((x) => new Set(x.s.witnessUnmatched || []));
+  const unmatched = first('witnessFeeds') ? [...unmatchedIn[0]].filter((fp) => unmatchedIn.every((u) => u.has(fp))) : [];
+  const overruled = all.flatMap((x) => (x.s.witnessOverruled || []).map((o) => ({ ...o, path: underRepo(x.repo, o.path) })));
+  const merged = {
+    byReach: addUp('byReach'), byEffect: addUp('byEffect'),
+    reachFeeds: first('reachFeeds'), reachFeedProblems: union('reachFeedProblems'),
+    reachNote: reachless.length ? `no reachability facts declared in ${of(reachless)}, so no finding there was judged reachable${driven ? `, and the ${driven} an attacker drives are labelled attacker-driven rather than exploitable` : ''}: name open/restricted transactions and jobs in each repository's cobolwork.site.json, or bring a COBOLWORK_REACH extract` : null,
+    effectNote: effectless.length ? `no authority facts declared in ${of(effectless)}, so no finding there was judged to run privileged: name privilegedTransactions/privilegedJobs in each repository's cobolwork.site.json, or bring them in the COBOLWORK_REACH extract` : null,
+    witnessFeeds: first('witnessFeeds'), byWitness: addUp('byWitness'), witnessFeedProblems: union('witnessFeedProblems'),
+    witnessUnmatched: unmatched, witnessOverruled: overruled,
+  };
+  return Object.fromEntries(Object.entries(merged).filter(([, v]) => (Array.isArray(v) ? v.length : v)));
+}
+
 function scanEach(root, opts) {
-  const reports = opts.repos.map(repo => ({ repo, r: scanAll(join(root, repo), { ...opts, repos: null, repoName: repo }) }));
+  // A feed is refused anywhere inside the scanned root, not only inside the repository being read.
+  const reports = opts.repos.map(repo => ({ repo, r: scanAll(join(root, repo), { ...opts, repos: null, repoName: repo, feedRoot: opts.feedRoot || root }) }));
   const findings = [];
   const checked = [];
-  const prefixed = (repo, f) => ({ ...f, path: underRepo(repo, f.path), ...(f.related ? { related: f.related.map(x => ({ ...x, path: underRepo(repo, x.path) })) } : {}) });
+  const fixedAt = (repo, x) => (x?.fixAt ? { exploitability: { ...x, fixAt: { ...x.fixAt, path: underRepo(repo, x.fixAt.path) } } } : {});
+  const prefixed = (repo, f) => ({ ...f, path: underRepo(repo, f.path), ...(f.related ? { related: f.related.map(x => ({ ...x, path: underRepo(repo, x.path) })) } : {}), ...fixedAt(repo, f.exploitability) });
   for (const { repo, r } of reports) {
     for (const f of r.findings) findings.push(prefixed(repo, f));
     for (const f of r.checked || []) checked.push(prefixed(repo, f));
@@ -51,7 +87,9 @@ function scanEach(root, opts) {
   for (const f of findings) bySeverity[f.sev] = (bySeverity[f.sev] || 0) + 1;
   const byEvidence = {};
   for (const f of findings) byEvidence[f.evidence] = (byEvidence[f.evidence] || 0) + 1;
-  const perRepo = Object.fromEntries(reports.map(({ repo, r }) => [repo, { findings: r.summary.findings, filesScanned: r.summary.filesScanned, coverageIncomplete: r.summary.coverageIncomplete, nosrc: r.summary.nosrc }]));
+  const byExploitability = byVerdict(findings);
+  const perRepo = Object.fromEntries(reports.map(({ repo, r }) => [repo, { findings: r.summary.findings, filesScanned: r.summary.filesScanned, coverageIncomplete: r.summary.coverageIncomplete, nosrc: r.summary.nosrc,
+    ...(r.summary.byExploitability ? { byExploitability: r.summary.byExploitability } : {}) }]));
   const filesScanned = sum('filesScanned');
   return {
     tool: 'cobolwork',
@@ -68,6 +106,9 @@ function scanEach(root, opts) {
       ...(reports[0]?.r.summary.advisoryCoverage ? { advisoryCoverage: reports[0].r.summary.advisoryCoverage } : {}),
       // The schema has no repository field for a set, so the repository leads the reason.
       setsIncomplete: reports.flatMap(({ repo, r }) => (r.summary.setsIncomplete || []).map((x) => ({ ...x, why: `${repo}: ${x.why}` }))),
+      ...mergeEstate(reports),
+      ...(byExploitability ? { byExploitability } : {}),
+      ...(byExploitability?.exploitable || byExploitability?.confirmed ? { handling: HANDLING } : {}),
     },
     findings,
     ...(checked.length ? { checked } : {}),
@@ -77,6 +118,7 @@ function scanEach(root, opts) {
     ruleImpact: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.impact).map(([k, v]) => [k, v.impact])),
     ruleRemedy: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.remedy).map(([k, v]) => [k, v.remedy])),
     evidence: EVIDENCE,
+    exploitabilityVerdicts: EXPLOITABILITY,
     // Which clause each rule bears on, and what the mapping does not claim. A reader who takes
     // this to an auditor needs both halves.
     ruleCompliance: complianceMap(Object.keys(ALL_RULES)),
@@ -85,6 +127,50 @@ function scanEach(root, opts) {
   };
 }
 
+// Who can reach each finding and what it runs as, from the estate's own facts - a brought
+// COBOLWORK_REACH extract, or the keys in cobolwork.site.json - never from the source, and the
+// exploitability verdict those join into with the route. Returns the summary keys that report them.
+// Reach and effect annotate rather than re-rank; where no fact is declared, a note says so rather
+// than the report reading as a clean bill.
+export function applyEstateFacts(findings, checked, root, opts = {}) {
+  const site = loadSite(root, opts.site || null);
+  const feedRoot = opts.feedRoot || root;
+  const reachFeeds = reachFeedPaths(opts).map((p) => loadReachFeed(p, { root: feedRoot }));
+  const reach = reachResolver({ feeds: reachFeeds, site });
+  const withEntries = findings.some((f) => (f.startedBy || []).length);
+  const byReach = reach.declared ? stampReach(findings, reach) : null;
+  const byEffect = reach.effectDeclared ? stampEffect(findings, reach) : null;
+  // A rule that escalates only under elevated authority takes its higher severity where the estate
+  // says the entry that reaches it runs privileged.
+  for (const f of findings) {
+    const raise = ALL_RULES[f.rule]?.whenPrivileged;
+    if (raise && f.effect === 'privileged') f.sev = raise;
+  }
+  stampExploitability(findings, reach, checked);
+  const witnessFeeds = witnessFeedPaths(opts).map((p) => loadWitnessFeed(p, { root: feedRoot }));
+  const witnessed = applyWitness(findings, checked, witnessFeeds);
+  if (witnessed.overruled.length) sortFindings(findings);
+  const byExploitability = byVerdict(findings);
+  const driven = byExploitability ? byExploitability['attacker-driven'] : 0;
+  const loaded = witnessFeeds.filter((f) => !f.problem);
+  return {
+    ...(byReach ? { byReach } : {}),
+    ...(byEffect ? { byEffect } : {}),
+    ...(reachFeeds.some(f => !f.problem) ? { reachFeeds: reachFeeds.filter(f => !f.problem).map(f => ({ file: f.file, extract: f.extract, retrieved: f.retrieved })) } : {}),
+    ...(reachFeeds.some(f => f.problem) ? { reachFeedProblems: reachFeeds.filter(f => f.problem).map(f => `${f.file}: ${f.problem}`) } : {}),
+    ...(!reach.declared && withEntries ? { reachNote: `no reachability facts declared, so no finding was judged reachable${driven ? `, and the ${driven} an attacker drives are labelled attacker-driven rather than exploitable` : ''}: name open/restricted transactions and jobs in cobolwork.site.json, or bring a COBOLWORK_REACH extract` } : {}),
+    ...(!reach.effectDeclared && withEntries ? { effectNote: 'no authority facts declared, so no finding was judged to run privileged: name privilegedTransactions/privilegedJobs in cobolwork.site.json, or bring them in the COBOLWORK_REACH extract' } : {}),
+    ...(byExploitability ? { byExploitability } : {}),
+    ...(byExploitability?.exploitable || byExploitability?.confirmed ? { handling: HANDLING } : {}),
+    ...(loaded.length ? { witnessFeeds: loaded.map((f) => ({ file: f.file, witness: f.witness, recorded: f.recorded })), byWitness: witnessed.byWitness } : {}),
+    ...(witnessFeeds.some((f) => f.problem || f.refused.length) ? { witnessFeedProblems: witnessFeeds.flatMap((f) => (f.problem ? [`${f.file}: ${f.problem}`] : f.refused.map((r) => `${f.file}: ${r.why}`))) } : {}),
+    // A result no path finding carries: the code changed since the test, or the route is gone.
+    ...(witnessed.unmatched.length ? { witnessUnmatched: witnessed.unmatched } : {}),
+    // Routes the reading refuted that the estate reproduced: the check model was wrong about them.
+    ...(witnessed.overruled.length ? { witnessOverruled: witnessed.overruled } : {}),
+  };
+}
+
 // A set that throws is reported as not having run, and the other sets' findings stand.
 function runSet(set, root, o) {
   try { return set.scan(root, o); } catch (e) {
@@ -153,21 +239,7 @@ export function scanAll(root, opts = {}) {
   const checked = parts.find((p) => p.tool === 'cobolwork-flow')?.checked || [];
   stampFingerprints(checked, { root, repo: opts.repoName || '' });
 
-  // Who can reach a finding: whether the transactions and jobs that start it are open to any user
-  // or restricted, from the estate's own facts - a brought COBOLWORK_REACH extract, or the
-  // open/restricted keys in cobolwork.site.json - never from the source. Undeclared until it says.
-  const site = loadSite(root, opts.site || null);
-  const reachFeeds = reachFeedPaths(opts).map((p) => loadReachFeed(p, { root }));
-  const reach = reachResolver({ feeds: reachFeeds, site });
-  const withEntries = findings.some((f) => (f.startedBy || []).length);
-  const byReach = reach.declared ? stampReach(findings, reach) : null;
-  const byEffect = reach.effectDeclared ? stampEffect(findings, reach) : null;
-  // A rule that escalates only under elevated authority takes its higher severity where the estate
-  // says the entry that reaches it runs privileged.
-  for (const f of findings) {
-    const raise = ALL_RULES[f.rule]?.whenPrivileged;
-    if (raise && f.effect === 'privileged') f.sev = raise;
-  }
+  const estate = applyEstateFacts(findings, checked, root, opts);
 
   const byRule = tally(findings);
   const bySeverity = {};
@@ -200,14 +272,7 @@ export function scanAll(root, opts = {}) {
       ...(parts.find(p => p.tool === 'cobolwork-build')?.summary.advisoryCoverage ? { advisoryCoverage: parts.find(p => p.tool === 'cobolwork-build').summary.advisoryCoverage } : {}),
       crossProgram: parts.find(p => p.tool === 'cobolwork-flow')?.summary.crossProgram ?? 0,
       ...(parts.find(p => p.tool === 'cobolwork-flow')?.summary.entryPoints?.roots ? rollup(findings) : {}),
-      // Reach annotates, it does not re-rank: severity is urgency, reach is who can drive it. When
-      // no fact is declared, the report says so rather than reading as a clean bill.
-      ...(byReach ? { byReach } : {}),
-      ...(byEffect ? { byEffect } : {}),
-      ...(reachFeeds.some(f => !f.problem) ? { reachFeeds: reachFeeds.filter(f => !f.problem).map(f => ({ file: f.file, extract: f.extract, retrieved: f.retrieved })) } : {}),
-      ...(reachFeeds.some(f => f.problem) ? { reachFeedProblems: reachFeeds.filter(f => f.problem).map(f => `${f.file}: ${f.problem}`) } : {}),
-      ...(!reach.declared && withEntries ? { reachNote: 'no reachability facts declared, so no finding was judged reachable: name open/restricted transactions and jobs in cobolwork.site.json, or bring a COBOLWORK_REACH extract' } : {}),
-      ...(!reach.effectDeclared && withEntries ? { effectNote: 'no authority facts declared, so no finding was judged to run privileged: name privilegedTransactions/privilegedJobs in cobolwork.site.json, or bring them in the COBOLWORK_REACH extract' } : {}),
+      ...estate,
       ruleSets: only,
       // Which flow model produced these rows, and which cobolwork. A finding that appears or
       // disappears between two reports is attributable to the model rather than to the code scanned.
@@ -260,6 +325,7 @@ export function scanAll(root, opts = {}) {
     ruleImpact: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.impact).map(([k, v]) => [k, v.impact])),
     ruleRemedy: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.remedy).map(([k, v]) => [k, v.remedy])),
     evidence: EVIDENCE,
+    exploitabilityVerdicts: EXPLOITABILITY,
     // Which clause each rule bears on, and what the mapping does not claim. A reader who takes
     // this to an auditor needs both halves.
     ruleCompliance: complianceMap(Object.keys(ALL_RULES)),

package/lib/sets/cics.mjs

@@ -13,6 +13,24 @@ import { parseCsd } from '../csd.mjs';
 // must act on from one that only wants a look; `remedy` is the standard fix, the same for every
 // instance. Both ride with every finding of the rule (as ruleImpact/ruleRemedy).
 export const CICS_RULES = {
+  'program-checks-stored-password': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-256',
+    text: 'A program compares a password it reads back from its own file or table',
+    impact: 'The password is kept where the application reads it, so whoever can read that file or table - a developer, a backup, an unload - holds every user\'s password, and the program, not the security manager, decides who signs on',
+    remedy: 'Verify the password with EXEC CICS VERIFY PASSWORD or SIGNON, so RACF checks it and the application never stores it',
+  },
+  'password-case-folded-before-compare': {
+    sev: 'low', evidence: 'construct', cwe: 'CWE-178',
+    text: 'A sign-on folds a password\'s case before comparing it',
+    impact: 'A password that matches in either case has fewer values to guess, and the program accepts a password its user never typed',
+    remedy: 'Compare the password as typed, or leave the comparison to the security manager with EXEC CICS VERIFY PASSWORD',
+  },
+  'cics-condition-ignored': {
+    sev: 'low', evidence: 'construct', cwe: 'CWE-252',
+    text: 'A program issues CICS commands whose failure it cannot see: NOHANDLE with no RESP, or IGNORE CONDITION',
+    impact: 'A command that fails - a record not found, a queue full, storage not available - returns to the next statement as if it had worked, so the program acts on an area the command never filled',
+    remedy: 'Give each command RESP and test it, or let the condition reach a HANDLE CONDITION that deals with it; keep NOHANDLE for commands whose failure is harmless',
+  },
   'cics-commarea-without-length-check': {
     sev: 'high', evidence: 'construct', cwe: 'CWE-1284',
     text: 'A program reads its communication area without checking EIBCALEN',
@@ -118,6 +136,38 @@ function execOptions(exec) {
 
 const subtreeRead = (x) => x.directRefs > 0 || x.children.some(subtreeRead);
 
+// Commands whose failure a program ordinarily lets pass: removing a temporary-storage queue that may
+// not exist, a line written to a transient-data log, the clock, a screen sent to a terminal that may
+// have gone, an ASSIGN, and the RETURN that ends the task anyway.
+const QUIET_FAILURES = (words) => (words[0] === 'DELETEQ' && words[1] === 'TS') || (words[0] === 'WRITEQ' && words[1] === 'TD')
+  || ['ASKTIME', 'FORMATTIME', 'SEND', 'ASSIGN', 'RETURN'].includes(words[0]);
+const SHOWN_IGNORED = 5;
+
+// Commands whose outcome the program cannot see: NOHANDLE with no RESP and no EIBRESP test before the
+// next command, and IGNORE CONDITION. One finding per program, at the first, since the count is what
+// a reviewer weighs and the fix is the same at each.
+function conditionsIgnored(p, path) {
+  const execs = p.execs.filter((e) => e.kind === 'CICS').sort((a, b) => a.line - b.line);
+  const hits = [];
+  execs.forEach((e, k) => {
+    const { opts: o, words } = execOptions(e);
+    if (words[0] === 'IGNORE' && words[1] === 'CONDITION') {
+      hits.push({ e, what: `IGNORE CONDITION ${words.slice(2).join(' ')}`.trim() });
+      return;
+    }
+    if (!words.includes('NOHANDLE') || o.has('RESP') || QUIET_FAILURES(words)) return;
+    const until = execs[k + 1] ? execs[k + 1].line : Infinity;
+    const tested = p.statements.some((st) => st.line > e.line && st.line < until && (st.sources || []).some((t) => t.t === 'word' && t.u === 'EIBRESP'));
+    if (!tested) hits.push({ e, what: `${words[0]}${words[1] && words[1] !== 'NOHANDLE' && !o.has(words[1]) ? ` ${words[1]}` : ''} NOHANDLE` });
+  });
+  if (!hits.length) return null;
+  const shown = hits.slice(0, SHOWN_IGNORED).map((h) => `${h.what} at line ${h.e.line}`).join(', ');
+  return {
+    rule: 'cics-condition-ignored', path, line: hits[0].e.line, program: p.id,
+    detail: `${p.id} leaves ${hits.length} place${hits.length === 1 ? '' : 's'} where a CICS command's failure goes unseen: ${shown}${hits.length > SHOWN_IGNORED ? `, and ${hits.length - SHOWN_IGNORED} more` : ''}`,
+  };
+}
+
 // Sizes come from the parser's data-division layout, which is graded against the compiler, so a
 // length compared here is the length the compiler would compute.
 //
@@ -194,6 +244,67 @@ export function scanCics(root, opts = {}) {
   }
 
   // Where a program sends control after its sign-on succeeds, and every other route there.
+  // A sign-on that compares a password the program read back from its own file or table, rather than
+  // asking the security manager, and one that folds a password's case first. Passwords are recognised
+  // by field name, as the sign-on rules above recognise them, and each finding says so.
+  function passwordChecks(p, path) {
+    if (p.execs.some((e) => e.kind === 'CICS' && /^(VERIFY|SIGNON)$/.test(execOptions(e).words[0] || ''))) return [];
+    const byName = new Map();
+    for (const it of p.items) if (!byName.has(it.name)) byName.set(it.name, it);
+    const resolve = (tok) => (tok && tok.t === 'word' ? p.resolved.get(tok) || byName.get(tok.u) || null : null);
+    const tests = [];
+    try { buildControl(p, resolve, { extra: (t) => { const r = signOnTest(t); if (r) tests.push(t); return r; } }); } catch { return []; }
+    if (!tests.length) return [];
+    // What the program reads back: an FD record, the INTO of a CICS READ, a host variable a SELECT or
+    // FETCH fills, and everything under any of them. A copy made by MOVE first is not followed.
+    const read = new Set();
+    for (const e of p.execs) {
+      const { opts: o, words } = execOptions(e);
+      if (e.kind === 'CICS' && /^READ(NEXT|PREV)?$/.test(words[0] || '')) for (const t of o.get('INTO') || []) if (t.t === 'word') read.add(t.u);
+      if (e.kind === 'SQL' && (e.hostVariables || []).length) for (const h of e.hostVariables) if (h.written && h.tok) read.add(h.tok.u);
+    }
+    const stored = (name) => {
+      for (let it = byName.get(name); it; it = it.parent) if (it.section === 'FILE' || read.has(it.name)) return true;
+      return false;
+    };
+    const out = [];
+    const FOLD = new Set(['UPPER-CASE', 'LOWER-CASE']);
+    for (const t of tests) {
+      const cond = t.cond || (t.evaluate && t.evaluate.conds[0]) || [];
+      const names = cond.filter((x, k) => x.t === 'word' && byName.has(x.u) && !(cond[k - 1] && /^(OF|IN)$/.test(cond[k - 1].u))).map((x) => x.u);
+      const kept = names.find(stored);
+      const line = t.st ? t.st.line : 1;
+      if (kept) {
+        out.push({
+          rule: 'program-checks-stored-password', path, line, program: p.id,
+          detail: `${p.id} compares ${names.join(' with ')}, and ${kept} is read back from the program's own file or table, so the password is stored where the application can read it; the password is recognised by its field name`,
+        });
+      }
+      if (cond.some((x) => x.t === 'word' && FOLD.has(x.u))) {
+        out.push({
+          rule: 'password-case-folded-before-compare', path, line, program: p.id,
+          detail: `${p.id} folds the case of ${names.join(' or ')} inside its sign-on comparison, so a password matches in either case; the password is recognised by its field name`,
+        });
+      }
+    }
+    // Case folded before the comparison: a MOVE of FUNCTION UPPER-CASE or LOWER-CASE of a password
+    // field, or an INSPECT that converts one.
+    const toks = (p.proc && p.proc.tokens) || [];
+    for (const st of p.statements || []) {
+      const seg = toks.slice(st.at + 1, st.end ?? st.at + 1);
+      const folds = st.verb === 'MOVE' ? seg.some((x) => x.t === 'word' && FOLD.has(x.u))
+        : st.verb === 'INSPECT' && seg.some((x) => x.t === 'word' && x.u === 'CONVERTING');
+      if (!folds) continue;
+      const pw = seg.find((x) => x.t === 'word' && PASSWORD.test(x.u) && byName.has(x.u));
+      if (!pw || out.some((o) => o.rule === 'password-case-folded-before-compare' && o.line === st.line)) continue;
+      out.push({
+        rule: 'password-case-folded-before-compare', path, line: st.line, program: p.id,
+        detail: `${p.id} folds the case of ${pw.u} with ${st.verb === 'MOVE' ? 'FUNCTION UPPER-CASE or LOWER-CASE' : 'INSPECT CONVERTING'} in a program that compares passwords, so a password matches in either case; the password is recognised by its field name`,
+      });
+    }
+    return out;
+  }
+
   function signOnBypasses(p, path) {
     let ctl;
     const byName = new Map();
@@ -238,6 +349,9 @@ export function scanCics(root, opts = {}) {
     stats.filesScanned++;
     const path = relPath(root, f);
     for (const p of r.programs) {
+      const ignored = conditionsIgnored(p, path);
+      if (ignored) findings.push(ignored);
+      if (p.refs.some((x) => PASSWORD.test(x.tok.u))) findings.push(...passwordChecks(p, path));
       const sum = summarise(p, path);
       summaries.push(sum);
       if (p.id && !commareaSize.has(p.id)) commareaSize.set(p.id, sum.commarea ? sum.commarea.size : null);