@portll/cobolwork 0.3.0 → 0.4.0

package/lib/parser.mjs

@@ -8,7 +8,8 @@ import {
   EIB_FIELDS, DIB_FIELDS, SQLCA_FIELDS,
 } from './words.mjs';
 import { CICS_COMMANDS, CICS_EVERY_COMMAND } from './cics-commands.mjs';
-import { cicsCommand } from './precompile-cics.mjs';
+import { cicsCommand, symbolicMapCopybook } from './precompile-cics.mjs';
+import { parseBms } from './bms.mjs';
 import { BINARY_SIZE, literalBytes, computeSizes, layoutReport } from './layout.mjs';
 import { hostVariablesIn } from './embedded-sql.mjs';
 import { join, dirname, basename, resolve, isAbsolute, sep, delimiter } from 'node:path';
@@ -88,7 +89,7 @@ export function detectFormat(src) {
 function codePastColumn72(src) {
   const lines = src.split(/\r?\n/, 2001);
   for (let i = 0; i < Math.min(lines.length, 2000); i++) {
-    const l = expandTabs(lines[i]).replace(/\s+$/, '');
+    const l = expandTabs(lines[i]).trimEnd();
     if (l.length <= 72 || l[6] === '*' || l[6] === '/' || /^\s*\*>/.test(l) || COMMENT_ENTRY.test(l.slice(7))) continue;
     const { quote, comment } = stateAtColumn72(l);
     if (comment) continue;
@@ -138,9 +139,42 @@ function scanQuotes(text, open) {
 
 const PREDEFINED = new Map([['P64', 'SET']]);
 
+// Cuts a floating comment where /\*>.*$/ would: at the first *> after the last line break.
+function withoutInlineComment(s) {
+  let from = 0;
+  for (const b of ['\n', '\r', '\u2028', '\u2029']) from = Math.max(from, s.lastIndexOf(b) + 1);
+  const at = s.indexOf('*>', from);
+  return at < 0 ? s : s.slice(0, at);
+}
+
+// The name, value and OVERRIDE of a >>DEFINE body as /^(?:CONSTANT\s+)?([A-Za-z0-9_-]+)\s+(?:AS\s+)?(.*?)\s*(OVERRIDE)?\s*$/i
+// reads them, in time linear in the body.
+function defineParts(body) {
+  const space = (c) => c !== undefined && /\s/.test(c);
+  const skip = (i) => { while (space(body[i])) i++; return i; };
+  const from = (start) => {
+    let j = start;
+    while (j < body.length && /[A-Za-z0-9_-]/.test(body[j])) j++;
+    if (j === start || !space(body[j])) return null;
+    let v = skip(j);
+    if (/^AS$/i.test(body.slice(v, v + 2)) && space(body[v + 2])) v = skip(v + 2);
+    let end = body.length;
+    while (end > v && space(body[end - 1])) end--;
+    let override;
+    if (end - 8 >= v && /^OVERRIDE$/i.test(body.slice(end - 8, end))) {
+      override = body.slice(end - 8, end);
+      end -= 8;
+      while (end > v && space(body[end - 1])) end--;
+    }
+    const value = body.slice(v, end);
+    return /[\n\r\u2028\u2029]/.test(value) ? null : [body, body.slice(start, j), value, override];
+  };
+  return (/^CONSTANT$/i.test(body.slice(0, 8)) && space(body[8]) && from(skip(8))) || from(0);
+}
+
 function defineDirective(directive, defines) {
-  const body = directive.replace(/\*>.*$/, '').replace(/^>>\s*DEFINE\s+/i, '').trim();
-  const m = body.match(/^(?:CONSTANT\s+)?([A-Za-z0-9_-]+)\s+(?:AS\s+)?(.*?)\s*(OVERRIDE)?\s*$/i);
+  const body = withoutInlineComment(directive).replace(/^>>\s*DEFINE\s+/i, '').trim();
+  const m = defineParts(body);
   if (!m) return;
   const name = m[1].toUpperCase();
   const raw = m[2].trim();
@@ -153,17 +187,17 @@ function defineDirective(directive, defines) {
 function setDirective(text, defines) {
   const c = /\bCONSTANT\s+([A-Za-z0-9_-]+)\s+(?:(["'])(.*?)\2|(\S+))/i.exec(text);
   if (c && defines) defines.set(c[1].toUpperCase(), c[3] !== undefined ? c[3] : c[4]);
-  const m = text.match(/SOURCEFORMAT\s*\(?\s*["']?(FREE|FIXED|VARIABLE)/i);
+  const m = text.match(/SOURCEFORMAT\s*(?:\(\s*)?["']?(FREE|FIXED|VARIABLE)/i);
   return m ? m[1].toLowerCase() : null;
 }
 
 function evaluateCondition(text, defines) {
-  const t = text.replace(/\*>.*$/, '').trim();
+  const t = withoutInlineComment(text).trim();
   const known = (n) => (defines && defines.has(n)) || PREDEFINED.has(n);
   const valueOf = (n) => (defines && defines.has(n) ? defines.get(n) : PREDEFINED.get(n));
   let m = t.match(/^([A-Za-z0-9_-]+)\s+(?:IS\s+)?(NOT\s+)?(DEFINED|SET)$/i);
   if (m) { const r = known(m[1].toUpperCase()); return m[2] ? !r : r; }
-  m = t.match(/^([A-Za-z0-9_-]+)\s*(<=|>=|<>|=|<|>)\s*(['"]?)([^'"]*)\3$/);
+  m = t.match(/^([A-Za-z0-9_-]+)\s*(<=|>=|<>|=|<|>)\s*(?!\s)(['"]?)([^'"]*)\3$/);
   if (m) {
     const name = m[1].toUpperCase();
     if (!known(name)) return null;
@@ -583,7 +617,8 @@ function applyReplacing(tokens, pairs, maxGrowth = Infinity, byCopy = false) {
         if (p.mode || p.partial || p.from.toks.length !== 1 || p.to.toks.length > 1) continue;
         const pat = p.from.toks[0].v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const rep = p.to.toks[0] ? p.to.toks[0].v : '';
-        const v = tk.v.replace(new RegExp(`\\(${pat}\\)`, 'gi'), `(${rep})`);
+        // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- pat is escaped
+        const v = tk.v.replace(new RegExp(`\\(${pat}\\)`, 'gi'), () => `(${rep})`);
         if (v !== tk.v) tk = { ...tk, v, u: v };
       }
     }
@@ -790,15 +825,31 @@ function expand(tokens, ctx, stack, format) {
   return out;
 }
 
+// The symbolic map BMS would generate for a COBOL mapset the tree holds only as BMS source, each
+// line placed at the BMS statement it comes from.
+function symbolicMapFor(name, ctx) {
+  const want = name.toUpperCase();
+  for (const p of filesByName(ctx.fileIndex).get(`${name}.bms`.toLowerCase()) || []) {
+    let mapsets;
+    try { ({ mapsets } = parseBms(ctx.readText(p))); } catch { continue; }
+    const mapset = mapsets.find((m) => m.name?.toUpperCase() === want && String(m.options?.lang || 'COBOL').toUpperCase() === 'COBOL');
+    const copybook = mapset && symbolicMapCopybook(mapset);
+    if (copybook) return { path: p, ...copybook };
+  }
+  return null;
+}
+
 function includeCopy(name, lib, pairs, at, via, ctx, stack, inheritedFormat) {
-  const path = resolveCopy(name, lib, ctx);
   const refused = copyRefusal(name, ctx);
-  const record = { name, lib, via, file: at.file, line: at.line, status: path ? 'resolved' : refused || (SYSTEM_COPY.test(name) ? 'system' : 'missing'), path };
+  let path = resolveCopy(name, lib, ctx);
+  const generated = !path && !refused && !lib && via === 'copy' && ctx.fileIndex ? symbolicMapFor(name, ctx) : null;
+  if (generated) path = generated.path;
+  const record = { name, lib, via, file: at.file, line: at.line, status: path ? 'resolved' : refused || (SYSTEM_COPY.test(name) ? 'system' : 'missing'), path, ...(generated ? { generatedFrom: 'bms' } : {}) };
   ctx.copies.push(record);
   if (!path) return [];
   if (stack.includes(path) || stack.length > 40) { record.status = 'recursive'; return []; }
   if (++ctx.inclusions > MAX_INCLUSIONS || ctx.copyTokens > MAX_COPY_TOKENS) { record.status = 'expansion-limit'; return []; }
-  const src = ctx.readText(path);
+  const src = generated ? generated.text : ctx.readText(path);
   // A copybook is read in the format in force where the COPY statement sits, which a >>SOURCE
   // directive earlier in the including file may have changed from the file's starting format.
   const fmt = detectFormat(src) === 'terminal' && ctx.copyFormat === 'auto' ? 'terminal' : (at.fmt || (ctx.copyFormat !== 'auto' ? ctx.copyFormat : (inheritedFormat || ctx.mainFormat)));
@@ -812,10 +863,13 @@ function includeCopy(name, lib, pairs, at, via, ctx, stack, inheritedFormat) {
     const f = p.from.toks;
     if (p.mode || !f.length) continue;
     const pat = f.map(t => t.v).join('');
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- escaped
     if (p.from.pseudo && /^[:(][A-Za-z0-9_-]*[:)]$/.test(pat)) { partial.push([p, new RegExp(escape(pat), 'gi')]); continue; }
     if (p.from.pseudo || f.length !== 1 || f[0].t !== 'lit') continue;
     const lit = `(['"])${escape(f[0].v)}\\1`;
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- lit is escaped
     const touching = new RegExp(`${lit}(?=[A-Za-z0-9-])|(?<=[A-Za-z0-9-])${lit}`);
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- lit is escaped
     if (norm.entries.some(e => touching.test(e.text))) partial.push([p, new RegExp(lit, 'g')]);
   }
   if (partial.length) {
@@ -832,6 +886,7 @@ function includeCopy(name, lib, pairs, at, via, ctx, stack, inheritedFormat) {
     for (const [p] of partial) p.partial = true;
   }
   const { tokens, diags } = tokenize(norm, path);
+  if (generated) for (const t of tokens) t.line = generated.lines[t.line - 1] ?? t.line;
   ctx.copyTokens += tokens.length;
   ctx.diags.push(...diags, ...norm.diags.map(d => ({ ...d, file: path })));
   const expanded = expand(tokens, ctx, [...stack, path], norm.finalFormat);
@@ -1855,7 +1910,7 @@ function collectCopybookDefines(src, format, ctx, depth) {
     const sw = /(?:^|\s)>>\s*SOURCE\s+(?:FORMAT\s+)?(?:IS\s+)?(FREE|FIXED|VARIABLE|TERMINAL)/i.exec(l);
     if (sw) { current = sw[1].toLowerCase(); continue; }
     if (current !== 'free' && current !== 'terminal' && l.length > 6 && '*/'.includes(l[6])) continue;
-    const code = l.replace(/\*>.*$/, '');
+    const code = withoutInlineComment(l);
     const m = /(?:^|[\s.])COPY\s+("[^"]+"|'[^']+'|[A-Za-z0-9_-]+)/i.exec(code);
     if (!m) continue;
     const name = m[1].replace(/^["']|["']$/g, '');

package/lib/precompile-cics.mjs

@@ -122,12 +122,14 @@ export const constantsCopybook = (names) => `${names.map((n) => `       01 ${n}
 // prefix when TIOAPFX=YES, then for each named field its length, flag or attribute byte, extended
 // attribute bytes and data, the output record redefining the input. Grouped (GRPNAME) and OCCURS
 // fields are laid out differently, and a mapset holding either is not written. Returns the copybook
-// text and the names it declares, or null.
+// text, the names it declares and, for each of its lines, the BMS line it comes from; or null.
 const ATTRIBUTE_LETTER = { COLOR: 'C', PS: 'P', HILIGHT: 'H', VALIDN: 'V', OUTLINE: 'U', SOSI: 'M', TRANSP: 'T' };
 export function symbolicMapCopybook(mapset) {
   const out = [];
   const names = [];
-  const line = (s) => out.push(`       ${s}`);
+  const lines = [];
+  let from = mapset.line;
+  const line = (s) => { out.push(`       ${s}`); lines.push(from); };
   const declare = (n, s) => { names.push(n); line(s); };
   // The assembler writes FILLER; each gets a name here, the layout unchanged, so the grade can tell
   // the stand-in's items from the program's.
@@ -138,6 +140,7 @@ export function symbolicMapCopybook(mapset) {
     if (fields.some((f) => f.grpname || f.occurs > 1)) return null;
     const { input, output, attributes } = map.symbolic;
     if (!input && !output) continue;
+    from = map.line;
     const prefix = String(map.operands?.get?.('TIOAPFX') ?? mapset.options.tioapfx ?? '').toUpperCase() === 'YES';
     const pic = (f, which) => f[which] || `X(${f.length})`;
     if (input) {
@@ -145,6 +148,7 @@ export function symbolicMapCopybook(mapset) {
       if (prefix) line(`    02  ${filler(input)} PIC X(12).`);
       for (const f of fields) {
         const n = f.name.toUpperCase();
+        from = f.line;
         declare(`${n}L`, `    02  ${n}L COMP PIC S9(4).`);
         declare(`${n}F`, `    02  ${n}F PIC X.`);
         line(`    02  ${filler(input)} REDEFINES ${n}F.`);
@@ -154,10 +158,12 @@ export function symbolicMapCopybook(mapset) {
       }
     }
     if (output) {
+      from = map.line;
       declare(output, input ? `01  ${output} REDEFINES ${input}.` : `01  ${output}.`);
       if (prefix) line(`    02  ${filler(output)} PIC X(12).`);
       for (const f of fields) {
         const n = f.name.toUpperCase();
+        from = f.line;
         if (input) line(`    02  ${filler(output)} PIC X(3).`);
         else { line(`    02  ${filler(output)} PIC X(2).`); declare(`${n}A`, `    02  ${n}A PIC X.`); }
         for (const a of attributes) declare(`${n}${ATTRIBUTE_LETTER[a]}`, `    02  ${n}${ATTRIBUTE_LETTER[a]} PIC X.`);
@@ -165,5 +171,5 @@ export function symbolicMapCopybook(mapset) {
       }
     }
   }
-  return out.length ? { text: `${out.join('\n')}\n`, names } : null;
+  return out.length ? { text: `${out.join('\n')}\n`, names, lines } : null;
 }

package/lib/precompile.mjs

@@ -188,7 +188,7 @@ function place(lines, block, format, text) {
     while (w < words.length && writeFrom + out.length + (out ? 1 : 0) + words[w].length <= to) out += (out ? ' ' : '') + words[w++];
     const line = lines[li].padEnd(to);
     lines[li] = line.slice(0, blankFrom) + ' '.repeat(Math.max(0, writeFrom - blankFrom)) + out.padEnd(Math.max(0, to - Math.max(writeFrom, blankFrom))) + line.slice(to);
-    if (li !== block.endLine) lines[li] = lines[li].replace(/\s+$/, '');
+    if (li !== block.endLine) lines[li] = lines[li].trimEnd();
   }
   return words.slice(w);
 }
@@ -208,6 +208,7 @@ function spill(words, format) {
 }
 
 // A division or section header, or a word, standing alone: not part of a longer name.
+// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- callers pass literal patterns
 const word = (re) => new RegExp(`(?<![A-Z0-9-])${re}(?![A-Z0-9-])`, 'i');
 const HEADERS = [['procedure', word('PROCEDURE\\s+DIVISION')], ['linkage', word('LINKAGE\\s+SECTION')], ['data', word('DATA\\s+DIVISION')], ['after', word('(?:REPORT|SCREEN)\\s+SECTION')]];
 const PROGRAM_ID = word('PROGRAM-ID');
@@ -373,7 +374,7 @@ function translateText(t, shared, ctx, before = new Map(), after = new Map()) {
     }
     const rest = place(lines, b, format, text);
     if (periodOnly) {
-      lines[b.endLine] = lines[b.endLine].replace(/\s+$/, '');
+      lines[b.endLine] = lines[b.endLine].trimEnd();
       if (rest.length) { add(after, b.endLine, spill(rest, format)); state.spilled++; }
     } else if (rest.length) {
       // What followed END-EXEC - a period, or the rest of a sentence - follows the whole translation.

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"b242a380e1b8b7d8bb8ff2d6e03e2c8a30242967","tag":"v0.3.0"}
+{"commit":"371041fbffe625df6b0a872249cf071268fcb6a6"}

package/lib/sarif.mjs

@@ -32,8 +32,9 @@ const LEVEL = { crit: 'error', high: 'error', med: 'warning', low: 'note', info:
 // Locations are URI references: each segment is encoded, lone surrogates from Windows names replaced first.
 const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
 const uriOf = (p) => String(p).split('/').map((seg) => encodeURIComponent(seg.replace(LONE_SURROGATE, '\uFFFD'))).join('/');
-// Square brackets in a SARIF message are link syntax, and a finding's text can quote the tree.
-const textOf = (s) => (typeof s === 'string' ? s.replace(/[[\]]/g, '\\$&') : s);
+// Square brackets in a SARIF message are link syntax, and a finding's text can quote the tree. A
+// backslash escapes the character after it, so one before a bracket or a backslash is escaped too.
+const textOf = (s) => (typeof s === 'string' ? s.replace(/\\(?=[\\[\]])|[[\]]/g, '\\$&') : s);
 // SARIF's three levels fold critical into high and info into low, so the severity also travels as
 // the number GitHub code scanning ranks by. Info is coverage and context, which rank as nothing.
 const SECURITY_SEVERITY = { crit: '9.5', high: '8.0', med: '5.5', low: '3.0' };

package/lib/scan.mjs

@@ -74,7 +74,8 @@ function scanEach(root, opts) {
   const reports = opts.repos.map(repo => ({ repo, r: scanAll(join(root, repo), { ...opts, repos: null, repoName: repo, feedRoot: opts.feedRoot || root }) }));
   const findings = [];
   const checked = [];
-  const fixedAt = (repo, x) => (x?.fixAt ? { exploitability: { ...x, fixAt: { ...x.fixAt, path: underRepo(repo, x.fixAt.path) } } } : {});
+  const fixedAt = (repo, x) => (x?.fixAt ? { exploitability: { ...x, fixAt: { ...x.fixAt, path: underRepo(repo, x.fixAt.path),
+    ...(x.fixAt.builtInto ? { builtInto: { ...x.fixAt.builtInto, path: underRepo(repo, x.fixAt.builtInto.path) } } : {}) } } } : {});
   const prefixed = (repo, f) => ({ ...f, path: underRepo(repo, f.path), ...(f.related ? { related: f.related.map(x => ({ ...x, path: underRepo(repo, x.path) })) } : {}), ...fixedAt(repo, f.exploitability) });
   for (const { repo, r } of reports) {
     for (const f of r.findings) findings.push(prefixed(repo, f));

package/lib/sets/abend.mjs

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Abends an input caused, from the runs ironwork's fuzzing harness kept (docs/spec/evidence.md §13.6).
+//
+// A fuzz run is a directory: manifest.json names the program, the inputs and each run that ended in
+// an abend, and evidence/ holds each kept run's hash-chained journal. A finding is reported only
+// where the evidence verifies and the run's own journal records the abend the manifest claims, so
+// the finding rests on a record of the run rather than on the manifest's word.
+import { readFileSync, existsSync } from 'node:fs';
+import { delimiter, join, posix, basename } from 'node:path';
+import { report } from '../kernel/ruleset.mjs';
+import { verifyEvidence } from '../evidence/verify.mjs';
+
+export const ABEND_RULES = {
+  'input-causes-abend-s0c7': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-20',
+    text: 'An input the program accepts ends its run with a data exception (S0C7)',
+    impact: 'Whoever supplies that input can stop the program at will: a batch step abends and the job behind it does not finish, a transaction abends at the terminal',
+    remedy: 'Test the field with IS NUMERIC, or validate the record, before the arithmetic or MOVE the journal names, and reject the input rather than letting the data exception end the run',
+  },
+  'input-causes-abend-s0c4': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-119',
+    text: 'An input the program accepts ends its run with a protection exception (S0C4)',
+    impact: 'The input made the program address storage it does not own; the same input under another layout can read or overwrite other data before anything stops it',
+    remedy: 'Find the subscript, reference modification, pointer or parameter length the input controls at the line the journal names, and bound it before use',
+  },
+  'input-causes-abend-subscript-range': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-129',
+    text: 'An input the program accepts drives a subscript or reference modification out of range, and the run abends',
+    impact: 'SSRANGE caught the overrun and ended the run; compiled without SSRANGE, as production builds often are, the same input reads or writes storage beside the table or field',
+    remedy: 'Check the index against both ends of the table or field before the statement the journal names, and keep SSRANGE on for the build',
+  },
+  'input-causes-abend': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-248',
+    text: 'An input the program accepts ends its run with an abend',
+    impact: 'Whoever supplies that input can stop the program at will, and the abend code says what the program failed to handle',
+    remedy: 'Read the abend code and the line the journal names, and handle the condition the input raises before it ends the run',
+  },
+};
+
+// IBM's messages for an SSRANGE failure: a subscript or index, an OCCURS DEPENDING ON object, and a
+// reference modification's start, length, and start plus length.
+const RANGE_MESSAGES = /^IGZ00(06|07|72|73|74)S\b/;
+
+export function abendRunPaths(opts = {}) {
+  if (opts.abendRuns) return opts.abendRuns;
+  return (process.env.COBOLWORK_ABENDS || '').split(delimiter).filter(Boolean);
+}
+
+export function abendRule(abend) {
+  if (abend.code === 'S0C7') return 'input-causes-abend-s0c7';
+  if (abend.code === 'S0C4') return 'input-causes-abend-s0c4';
+  if (RANGE_MESSAGES.test(abend.message || '')) return 'input-causes-abend-subscript-range';
+  return 'input-causes-abend';
+}
+
+// The abend a kept run's own journal records, or null.
+function journalAbend(evidenceDir, runId) {
+  if (typeof runId !== 'string' || !/^[0-9TZ]+-[0-9a-f]{16}$/.test(runId)) return null;
+  const file = join(evidenceDir, 'runs', `${runId}.jsonl`);
+  if (!existsSync(file)) return null;
+  for (const line of readFileSync(file, 'utf8').split('\n')) {
+    if (!line) continue;
+    const rec = JSON.parse(line);
+    if (rec.kind === 'abend') return rec;
+  }
+  return null;
+}
+
+const isString = (x) => typeof x === 'string' && x.length > 0;
+
+// One fuzz run: its findings, and what kept any of it from counting.
+export function loadAbendRun(dir) {
+  const out = { dir: basename(dir), program: null, findings: [], problems: [], counts: null, notModelled: 0 };
+  let doc;
+  try { doc = JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')); } catch (e) {
+    out.problems.push(e.code ? `manifest.json could not be read (${e.code})` : `manifest.json is not JSON (${e.message})`);
+    return out;
+  }
+  if (!doc || doc.tool !== 'ironwork-fuzz' || !doc.program || !isString(doc.program.file) || !Array.isArray(doc.inputs) || !Array.isArray(doc.runs)) {
+    out.problems.push('manifest.json is not an ironwork-fuzz manifest with a program, inputs and runs');
+    return out;
+  }
+  const programFile = posix.normalize(doc.program.file.replace(/\\/g, '/'));
+  if (programFile.startsWith('../') || posix.isAbsolute(programFile)) {
+    out.problems.push(`the program ${doc.program.file} is outside the scanned tree`);
+    return out;
+  }
+  out.program = { file: programFile, id: isString(doc.program.id) ? doc.program.id : null };
+  out.counts = doc.counts && typeof doc.counts === 'object' ? doc.counts : null;
+
+  const evidenceDir = join(dir, 'evidence');
+  const verdict = verifyEvidence(evidenceDir);
+  if (!verdict.verified) {
+    out.problems.push(`its evidence does not verify: ${verdict.broken.map((b) => `${b.file}:${b.line} ${b.check}`).join(', ') || 'nothing is recorded'}`);
+    return out;
+  }
+  const inputs = new Map(doc.inputs.filter((i) => i && isString(i.id)).map((i) => [i.id, i]));
+  const seen = new Map();
+  for (const run of doc.runs) {
+    if (!run || run.outcome !== 'abend' || !run.abend || !isString(run.abend.code)) continue;
+    if (run.abend.code === 'IRONWORK') { out.notModelled++; continue; }
+    const recorded = journalAbend(evidenceDir, run.journal);
+    if (!recorded || recorded.code !== run.abend.code) {
+      out.problems.push(`run ${run.journal ?? '(unnamed)'}: its journal does not record the abend ${run.abend.code} the manifest gives`);
+      continue;
+    }
+    // Where the journal names the abend's place, that is the place, and a manifest that says otherwise is not believed.
+    const claimed = { file: run.abend.file, line: run.abend.line };
+    const place = isString(recorded.file) && Number.isInteger(recorded.line) ? { file: recorded.file, line: recorded.line } : claimed;
+    if (place !== claimed && ((isString(claimed.file) && claimed.file !== place.file) || (claimed.line != null && claimed.line !== place.line))) {
+      out.problems.push(`run ${run.journal}: its journal records the abend at ${place.file}:${place.line}, not where the manifest puts it`);
+      continue;
+    }
+    const where = isString(place.file) ? posix.normalize(posix.join(posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
+    const line = Number.isInteger(place.line) && place.line > 0 ? place.line : 1;
+    const rule = abendRule(run.abend);
+    const used = (Array.isArray(run.input) ? run.input : []).map((id) => inputs.get(id)).filter(Boolean)
+      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}) }));
+    const key = `${rule}|${where}|${line}`;
+    const size = used.reduce((n, i) => n + String(i.bytes || '').length, 0);
+    const held = seen.get(key);
+    if (held && held.size <= size) continue;
+    const finding = {
+      rule, path: where, line, program: out.program.id,
+      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept`,
+      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}) },
+      input: used, run: { dir: out.dir, journal: run.journal },
+    };
+    seen.set(key, { size, finding });
+  }
+  out.findings = [...seen.values()].map((s) => s.finding);
+  return out;
+}
+
+export function scanAbend(root, opts = {}) {
+  const dirs = abendRunPaths(opts);
+  const runs = dirs.map((d) => loadAbendRun(d));
+  const findings = runs.flatMap((r) => r.findings.filter((f) => existsSync(join(root, f.path))));
+  const stats = {
+    filesScanned: 0, filesUnreadable: 0,
+    abendRuns: runs.map((r) => ({ dir: r.dir, program: r.program ? r.program.file : null, findings: r.findings.length, ...(r.notModelled ? { notModelled: r.notModelled } : {}), ...(r.counts ? { counts: r.counts } : {}) })),
+    ...(runs.some((r) => r.problems.length) ? { abendRunProblems: runs.flatMap((r) => r.problems.map((p) => `${r.dir}: ${p}`)) } : {}),
+    ...(runs.some((r) => r.findings.some((f) => !existsSync(join(root, f.path)))) ? { abendRunsElsewhere: runs.flatMap((r) => r.findings.filter((f) => !existsSync(join(root, f.path))).map((f) => `${r.dir}: ${f.path}`)) } : {}),
+    setIncomplete: runs.some((r) => r.problems.length > 0),
+  };
+  return report('abend', { rules: ABEND_RULES, findings, stats, run: null });
+}
+

package/lib/sets/compile.mjs

@@ -93,7 +93,8 @@ function declaredIn(text, names, into) {
 // A reference cut at column 72 names a word the source does not hold.
 function truncated(ref, lines) {
   const line = (lines.get(ref.file) || [])[ref.line - 1] || '';
-  const re = new RegExp(`(?<![A-Za-z0-9-])${ref.name.replace(/[$#@]/g, '\\$&')}`, 'gi');
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- the name is escaped
+  const re = new RegExp(`(?<![A-Za-z0-9-])${ref.name.replace(/[.*+?^${}()|[\]\\#@]/g, '\\$&')}`, 'gi');
   let whole = false;
   let any = false;
   let m;

package/lib/sets/hidden.mjs

@@ -127,7 +127,7 @@ const SEQUENCE_NUMBER = /^[A-Za-z]{0,4}\d{2,6}$/;
 const FIXED_INDICATOR = /^[ */\-Dd$]$/;
 const NOT_CODE = /^(\*>|\/\/|\/\*)/;
 // A directive that makes the rest of the file free format, where columns 1-6 are ordinary text.
-const TO_FREE = />>\s*SOURCE\s+(?:FORMAT\s+)?(?:IS\s+)?FREE\b|SOURCEFORMAT\s*\(?\s*["']?FREE/i;
+const TO_FREE = />>\s*SOURCE\s+(?:FORMAT\s+)?(?:IS\s+)?FREE\b|SOURCEFORMAT\s*(?:\(\s*)?["']?FREE/i;
 
 function sequencePayload(lines, format) {
   const rows = [];

package/lib/sets/jcl.mjs

@@ -154,6 +154,7 @@ const DESTRUCTIVE = /^\s*(DELETE(?!\s+FROM\b)|ALTER\s+\S+\s+NEWNAME|REPRO\b[^\n]
 // symbol ends it. An empty qualifier is a symbol the reader already filled with an empty default.
 const dsnKey = (dsn) => String(dsn || '').replace(/^['(]+|[')]+$/g, '').replace(/\(.*$/, '').toUpperCase()
   .replace(/&[A-Z0-9@#$]+\.?/g, '*').replace(/<[^>]*>/g, '*').replace(/\.(?=\.)/g, '.*');
+// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- k is escaped, and * widened to one qualifier
 const dsnPattern = (k) => new RegExp(`^${k.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^.]+')}$`);
 
 // The programs whose in-stream data can delete a catalogued dataset. A step running another known

package/lib/sets/recon.mjs

@@ -107,6 +107,7 @@ function routableAddresses(text, jcl) {
 // A qualifier matches on a whole dotted component, never on a substring: PROD matches PROD.MASTER
 // and PRODLIB.X only if PRODLIB was itself listed. Matching on substrings is how a rule like this
 // starts reporting every line in the estate.
+// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- q is escaped
 const qualifierPattern = (q) => new RegExp('(^|[^A-Z0-9$#@.])' + q.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '(?=[.\\s,)\'"]|$)', 'i');
 
 // JOBLIB and STEPLIB are where the system looks for the program, so what they hold is code rather

package/lib/utilities.mjs

@@ -118,6 +118,7 @@ function commands(lines) {
 // The values of the first of `names` given as a keyword in a command, as in INFILE(IN) or
 // OUTDDNAME(TAPE1,TAPE2). A name only counts at the start of a word, so INDD is not LOGINDD.
 function param(text, names) {
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- names are literal keyword lists
   const m = new RegExp(`(?:^|[\\s,])(?:${names.join('|')})\\s*\\(([^)]*)\\)`, 'i').exec(text);
   return m ? m[1].split(/[\s,]+/).filter(Boolean).map((v) => upper(v.replace(/^'|'$/g, ''))) : null;
 }
@@ -341,6 +342,7 @@ function icetoolCopies(step, dds) {
   for (const st of statements) {
     if (!['COPY', 'SORT', 'MERGE'].includes(st.op)) continue;
     const named = (kw) => st.operands.flatMap((o) => {
+      // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- kw is a literal keyword
       const m = new RegExp(`^${kw}\\((.*)\\)$`, 'i').exec(o);
       return m ? m[1].split(',').map((n) => upper(n.trim())).filter(Boolean) : [];
     });

package/lib/verify.mjs

@@ -18,7 +18,8 @@ const END_TASK = 'end the task from CEDF or CEDX, or stop the program in the deb
 // What goes in, and what reading it at the operation shows. `run` says what letting the operation run
 // shows; null means it would act on something, so the plan stops before it (`stopBefore`).
 const SINKS = {
-  arithmetic: (x) => ({ value: `a letter where ${x.item} expects a digit, such as A in its first position`, reads: `${x.item} holding the letter`, run: 'the task abends ASRA, a data exception (S0C7 in batch), at the operation' }),
+  // A letter's low half is 1 to 9 and its zone a valid sign, so zoned arithmetic reads it as a digit.
+  arithmetic: (x) => ({ value: `an asterisk in every position of ${x.item}, whose digits it expects: a letter will not do, since zoned decimal reads a letter as a digit`, reads: `${x.item} holding the asterisks`, run: 'the task abends ASRA, a data exception (S0C7 in batch), at the operation' }),
   subscript: (x) => bounds(x, `${x.table ? `${x.table + 1}, one more than the ${x.table} entries in the table` : 'one more than the entries in the table'}, or 0`),
   'loop-bound': (x) => bounds(x, `${x.table ? `${x.table + 1}, one more than the ${x.table} entries in the table` : 'one more than the entries in the table'}`),
   'reference-modification': (x) => bounds(x, 'one more than the length of the field, or 0'),