@portll/cobolwork 0.3.0 → 0.5.0

package/README.md

@@ -63,6 +63,13 @@ request and writes SARIF for code scanning: [docs/github-action.md](docs/github-
 | JCL | credentials and security commands in in-stream data, destructive statements, `DLM=` tricks, FTP in cleartext or sending production data, production data touched by a test job |
 | The source | names nothing declares (code that cannot compile), shadowed copybooks, payloads hidden in columns 73-80 or aimed at AI readers |
 | The estate | production names outside production jobs, routable addresses, compiler and runtime versions with published advisories |
+| Assembler | a switch to key zero or supervisor state, an instruction run through `EX`, cross-memory calls, the security product called directly, and the CSECT or ENTRY a COBOL `CALL` or a job step reaches |
+| Cryptography | a single-length DES key, an MD5 or SHA-1 hash, or a fixed initialization vector asked of ICSF, read from IBM's parameter lists; an outbound CICS connection asking for HTTP |
+
+HLASM is read, not assembled: its statements are read from the cards and its operations looked up
+in a table that cites the IBM manual for each (`rules/hlasm-operations.json`). Macros are not
+expanded and conditional assembly is not evaluated, so an operation a site macro issues is seen
+where the macro is defined, and not where it is used.
 
 [docs/rule-sets.md](docs/rule-sets.md) describes each in full, with what it deliberately leaves out.
 Vendor packs for CA ACF2 and Top Secret, Control-M and Connect:Direct load only for estates that
@@ -101,8 +108,20 @@ here can be checked.
 }
 ```
 
-`crossProgram` marks a path that left the file it started in. Findings carry no source text, so a
-report can be stored and passed on without carrying the code with it.
+`crossProgram` marks a path that left the file it started in. A value a CALL writes back through a
+parameter returns only to the call it came in through: in another caller's CALL the parameter is
+that caller's storage. A value the subprogram keeps in its own storage can reach any later caller.
+Findings carry no source text, so a report can be stored and passed on without carrying the code
+with it.
+
+`trace` is one route, the shortest, and sources that reach one sink are merged into one finding,
+counted in `sources`. With `--all-routes`, `scan` and `flow` give each path finding `routes`: every
+source, and every statement on any route from one of them to the sink, by verb, file and line.
+`complete` is false where the walk stopped at its budget or a step has no statement the engine can
+place. It leaves out no statement on a route the engine follows, and may name one no route takes:
+what a reader needs before saying a run covered every route (`docs/spec/reach.md` §9.8). Routes
+through what the engine does not read, such as an unparsed program or a caller written in another
+language, are not in it.
 
 `fingerprint` is what the finding is, rather than where it is printed today: the rule, the program
 and the paragraph or section it sits in (the job, step and DD for JCL), and the flagged statement's
@@ -113,7 +132,7 @@ that only their position tells apart share one, and `summary.identity.shared` co
 ### Findings and Claim Severity
 
 Severity says how urgent a finding is. `evidence` says what the tool actually established, which
-decides who acts on it. Every rule declares one of eight finding types:
+decides who acts on it. Every rule declares one of nine finding types:
 
 | `evidence` | What the finding claims | Who acts |
 |---|---|---|
@@ -123,6 +142,7 @@ decides who acts on it. Every rule declares one of eight finding types:
 | `advisory` | a pinned compiler or runtime matches a published advisory | whoever owns the build |
 | `exposure` | information about the estate is written into source | the owner |
 | `change` | a change moves an interface or adds a call target (`diff` only) | the reviewer of that change |
+| `execution` | a run of the program on a recorded input ended this way, and the run's verified journal is the record | the program's owner |
 | `coverage` | the analysis stopped following here | nobody's code; read more, or accept the limit |
 | `context` | describes the estate (an entry point, a product in use) | nobody; it asserts no defect |
 
@@ -160,8 +180,9 @@ declares its transaction open:
   ],
   "unknown": "whether it reproduces: a test on a system the estate owns, under its own authorisation, is the only confirmation",
   "fixAt": {
-    "program": "INQUIRY", "path": "INQUIRY.cbl", "line": 13, "item": "WS-STMT",
-    "test": "before the operation at INQUIRY.cbl:13, on every route to it, test WS-STMT against a list of the values allowed (...), and let only a value that passes reach it; a static statement with host variables needs no test"
+    "program": "INQUIRY", "path": "INQUIRY.cbl", "line": 11, "item": "WS-ACCT",
+    "builtInto": { "item": "WS-STMT", "path": "INQUIRY.cbl", "line": 13 },
+    "test": "before the STRING at INQUIRY.cbl:11 that builds WS-STMT, on every route to it, test WS-ACCT against a list of the values allowed (...), or WS-ACCT IS NUMERIC where it is a number, and let only a value that passes reach it; a static statement with host variables needs no test"
   }
 }
 ```
@@ -192,6 +213,11 @@ tests. A finding inside a paragraph they cover carries `executed`, the paragraph
 runs entered it, and `summary.byExecution` counts the findings in paragraphs entered and never
 entered ([docs/spec/evidence.md](docs/spec/evidence.md) §13.5).
 
+`COBOLWORK_ABENDS` names fuzz runs ironwork's harness wrote. Each abend an input caused becomes a
+finding at the line it happened, with the input and the run's journal, once that journal verifies:
+`input-causes-abend-s0c7`, `-s0c4`, `-subscript-range`, or `input-causes-abend` for any other code
+([docs/spec/evidence.md](docs/spec/evidence.md) §13.6).
+
 ### What each finding lets someone do, and the fix
 
 A defect finding carries two more facts, the same for every finding of its rule: what someone can do
@@ -349,10 +375,10 @@ and to a COBIT 2019 practice by identifier alone:
 
 | File | Instrument | Rules mapped |
 |---|---|---|
-| `rules/compliance-dora.json` | Regulation (EU) 2022/2554 (DORA) | 203 |
-| `rules/compliance-ffiec.json` | FFIEC IT Examination Handbook | 201, and 2 recorded as unmapped |
-| `rules/compliance-nist80053.json` | NIST SP 800-53 Rev. 5.2.0 | 201, and 2 recorded as unmapped |
-| `rules/compliance-cobit2019.json` | COBIT 2019 (ISACA), identifiers only | 201, and 2 recorded as unmapped |
+| `rules/compliance-dora.json` | Regulation (EU) 2022/2554 (DORA) | 207 |
+| `rules/compliance-ffiec.json` | FFIEC IT Examination Handbook | 205, and 2 recorded as unmapped |
+| `rules/compliance-nist80053.json` | NIST SP 800-53 Rev. 5.2.0 | 205, and 2 recorded as unmapped |
+| `rules/compliance-cobit2019.json` | COBIT 2019 (ISACA), identifiers only | 205, and 2 recorded as unmapped |
 
 A COBIT 2019 row names the objective or practice and gives this project's own rationale; no ISACA
 text is reproduced, so reading what a practice says needs a copy of the framework. The practice is

package/bin/cobolwork.mjs

@@ -80,6 +80,7 @@ Options
   --rules-path gitleaks print the path of the mainframe credential rules and exit
   --quiet               summary only
   --full-trace          list every hop of a data flow path, not its two ends
+  --all-routes          give each data flow finding every statement on any route from its sources (scan, flow)
   --base <ref>          diff: the git revision to compare against
   --head <ref>          diff: the revision under review (default: the working tree)
   --baseline <file>     judgements to apply; without it, ${BASELINE_FILE} in the scanned tree
@@ -145,6 +146,7 @@ function parseArgs(argv) {
     else if (a === '--rules-path') opts.rulesPath = argv[++i] || 'gitleaks';
     else if (a === '--quiet') opts.quiet = true;
     else if (a === '--full-trace') opts.fullTrace = true;
+    else if (a === '--all-routes') opts.allRoutes = true;
     else if (a === '--base') opts.base = value();
     else if (a === '--head') opts.head = value();
     else if (a === '--baseline') opts.baseline = value();
@@ -250,6 +252,10 @@ if (opts.fullTrace && opts._.length && !TRACE_COMMANDS.includes(opts._[0])) {
 `);
   process.exit(2);
 }
+if (opts.allRoutes && opts._.length && !['scan', 'flow'].includes(opts._[0])) {
+  process.stderr.write(`cobolwork: --all-routes is for scan and flow\n`);
+  process.exit(2);
+}
 const ADVISORY_COMMANDS = ['scan', 'baseline', 'tui', 'explain', 'build'];
 if (opts.advisoryFeeds && opts._.length && !ADVISORY_COMMANDS.includes(opts._[0])) {
   process.stderr.write(`cobolwork: ${opts._[0]} reads no advisories; ${ADVISORY_COMMANDS.join(', ')} do\n`);
@@ -340,7 +346,7 @@ try {
   } else if (command === 'evidence') {
     process.exitCode = evidenceCommand(target, opts, { toolVersion: VERSION, write: (s) => process.stdout.write(s) });
   } else if (command === 'scan' || command === 'flow') {
-    const flowOpts = { repos, fullTrace: opts.fullTrace === true, systemDirs };
+    const flowOpts = { repos, fullTrace: opts.fullTrace === true, allRoutes: opts.allRoutes === true, systemDirs };
     // The site file sits beside the members and is not one of them, so it is named rather than found.
     const site = resolve(root, SITE_FILE);
     const pds = opts.pdsExport ? pdsExportTree(root, { systemDirs }) : null;

package/lib/bms.mjs

@@ -55,6 +55,13 @@ const sublist = (v) => {
   return (inner ? splitOperands(inner[1]) : [v]).map((x) => x.trim()).filter(Boolean);
 };
 
+// L'NAME is NAME's length, and T', S', I', K', N', D' and O' its other attributes: the quote after the
+// letter opens no string when the letter starts a term and a symbol follows. CL8'TEXT' and D'1.5'
+// are constants, and their quotes do open one.
+// https://www.ibm.com/docs/en/hla-and-tf/1.6.0?topic=instructions-data-attributes
+const attributeReference = (text, i) => /[LTSIKNDO]/i.test(text[i - 1] || '')
+  && !/[A-Z0-9$#@_]/i.test(text[i - 2] || '') && /[A-Z$#@_&]/i.test(text[i + 1] || '');
+
 // Folds physical lines into statements. A map continues a statement in two ways, often both in one
 // file. An operand that fills the line to column 71 carries on in column 16 of the next line, which
 // is how a long INITIAL literal is split. A comma followed by a blank ends the line's operands and
@@ -78,6 +85,7 @@ export function foldStatements(src) {
     for (let i = from; i < text.length; i++) {
       const c = text[i];
       if (o.quoted) { o.st.field += c; if (c === "'") o.quoted = false; continue; }
+      if (c === "'" && attributeReference(text, i)) { o.st.field += c; continue; }
       if (c === "'") { o.quoted = true; o.st.field += c; continue; }
       if (c === ' ' || c === '\t') {
         o.reading = o.st.field.endsWith(',');

package/lib/capabilities.mjs

@@ -17,8 +17,8 @@ export const CAPABILITIES_SCHEMA_VERSION = 1;
 
 // Each command, what it takes and what it writes.
 export const COMMANDS = {
-  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
-  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
+  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--all-routes', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
+  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--all-routes', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
   inventory: { args: ['<path>'], options: ['--out', '--quiet', '--copylib', '--evidence'], documents: ['cobolwork-inventory'] },
   parse: { args: ['<file>'], options: ['--out'], documents: ['cobolwork-parse'] },
   sbom: { args: ['<path>'], options: ['--name', '--out', '--quiet', '--copylib', '--evidence'], documents: ['cyclonedx'] },

package/lib/cics-commands.mjs

@@ -11,72 +11,338 @@
 // defaults to, named from another option's argument (defaults).
 export const CICS_COMMANDS = {
   "ABEND": {"options":{"ABCODE":"sends"}},
-  "ADDRESS": {"options":{"ACEE":"receives","COMMAREA":"receives","CWA":"receives","EIB":"receives","TCTUA":"receives","TWA":"receives"}},
+  "ADDRESS": {
+    "options": {
+      "ACEE": "receives", "COMMAREA": "receives", "CWA": "receives", "EIB": "receives",
+      "TCTUA": "receives", "TWA": "receives",
+    },
+  },
   "ADDRESS SET": {"identify":["SET"],"options":{"SET":"receives","USING":"sends"}},
   "ASKTIME": {"options":{"ABSTIME":"receives"}},
-  "ASSIGN": {"options":{"ABCODE":"receives","MAPLINE":"receives","ABDUMP":"receives","MAPWIDTH":"receives","ABOFFSET":"receives","MICROVERSION":"receives","ABPROGRAM":"receives","MINORVERSION":"receives","ACTIVITY":"receives","MSRCONTROL":"receives","ACTIVITYID":"receives","NATLANGINUSE":"receives","ALTSCRNHT":"receives","NETNAME":"receives","ALTSCRNWD":"receives","NEXTTRANSID":"receives","APLKYBD":"receives","NUMTAB":"receives","APLTEXT":"receives","OPCLASS":"receives","APPLICATION":"receives","OPERATION":"receives","APPLID":"receives","OPERKEYS":"receives","ASRAINTRPT":"receives","OPID":"receives","ASRAKEY":"receives","OPSECURITY":"receives","ASRAPSW":"receives","ORGABCODE":"receives","ASRAPSW16":"receives","OUTLINE":"receives","ASRAREGS":"receives","PAGENUM":"receives","ASRAREGS64":"receives","PARTNPAGE":"receives","ASRASPC":"receives","PARTNS":"receives","ASRASTG":"receives","PARTNSET":"receives","BRIDGE":"receives","PLATFORM":"receives","BTRANS":"receives","PRINSYSID":"receives","CHANNEL":"receives","PROCESS":"receives","CMDSEC":"receives","PROCESSTYPE":"receives","COLOR":"receives","PROGRAM":"receives","CWALENG":"receives","PS":"receives","DEFSCRNHT":"receives","QNAME":"receives","DEFSCRNWD":"receives","RESSEC":"receives","DELIMITER":"receives","RESTART":"receives","DESTCOUNT":"receives","RETURNPROG":"receives","DESTID":"receives","SCRNHT":"receives","DESTIDLENG":"receives","SCRNWD":"receives","DSSCS":"receives","SIGDATA":"receives","DS3270":"receives","SOSI":"receives","ERRORMSG":"receives","STARTCODE":"receives","ERRORMSGLEN":"receives","STATIONID":"receives","EWASUPP":"receives","SYSID":"receives","EXTDS":"receives","TASKPRIORITY":"receives","FACILITY":"receives","TCTUALENG":"receives","FCI":"receives","TELLERID":"receives","GCHARS":"receives","TERMCODE":"receives","GCODES":"receives","TERMPRIORITY":"receives","GMMI":"receives","TEXTKYBD":"receives","HILIGHT":"receives","TEXTPRINT":"receives","INITPARM":"receives","TRANPRIORITY":"receives","INITPARMLEN":"receives","TWALENG":"receives","INPARTN":"receives","UNATTEND":"receives","INPUTMSGLEN":"receives","USERID":"receives","INVOKINGPROG":"receives","USERNAME":"receives","KATAKANA":"receives","USERPRIORITY":"receives","LANGINUSE":"receives","VALIDATION":"receives","LDCMNEM":"receives","LDCNUM":"receives","LINKLEVEL":"receives","MAJORVERSION":"receives","MAPCOLUMN":"receives","MAPHEIGHT":"receives"}},
+  "ASSIGN": {
+    "options": {
+      "ABCODE": "receives", "MAPLINE": "receives", "ABDUMP": "receives", "MAPWIDTH": "receives",
+      "ABOFFSET": "receives", "MICROVERSION": "receives", "ABPROGRAM": "receives",
+      "MINORVERSION": "receives", "ACTIVITY": "receives", "MSRCONTROL": "receives",
+      "ACTIVITYID": "receives", "NATLANGINUSE": "receives", "ALTSCRNHT": "receives",
+      "NETNAME": "receives", "ALTSCRNWD": "receives", "NEXTTRANSID": "receives", "APLKYBD": "receives",
+      "NUMTAB": "receives", "APLTEXT": "receives", "OPCLASS": "receives", "APPLICATION": "receives",
+      "OPERATION": "receives", "APPLID": "receives", "OPERKEYS": "receives", "ASRAINTRPT": "receives",
+      "OPID": "receives", "ASRAKEY": "receives", "OPSECURITY": "receives", "ASRAPSW": "receives",
+      "ORGABCODE": "receives", "ASRAPSW16": "receives", "OUTLINE": "receives", "ASRAREGS": "receives",
+      "PAGENUM": "receives", "ASRAREGS64": "receives", "PARTNPAGE": "receives", "ASRASPC": "receives",
+      "PARTNS": "receives", "ASRASTG": "receives", "PARTNSET": "receives", "BRIDGE": "receives",
+      "PLATFORM": "receives", "BTRANS": "receives", "PRINSYSID": "receives", "CHANNEL": "receives",
+      "PROCESS": "receives", "CMDSEC": "receives", "PROCESSTYPE": "receives", "COLOR": "receives",
+      "PROGRAM": "receives", "CWALENG": "receives", "PS": "receives", "DEFSCRNHT": "receives",
+      "QNAME": "receives", "DEFSCRNWD": "receives", "RESSEC": "receives", "DELIMITER": "receives",
+      "RESTART": "receives", "DESTCOUNT": "receives", "RETURNPROG": "receives", "DESTID": "receives",
+      "SCRNHT": "receives", "DESTIDLENG": "receives", "SCRNWD": "receives", "DSSCS": "receives",
+      "SIGDATA": "receives", "DS3270": "receives", "SOSI": "receives", "ERRORMSG": "receives",
+      "STARTCODE": "receives", "ERRORMSGLEN": "receives", "STATIONID": "receives",
+      "EWASUPP": "receives", "SYSID": "receives", "EXTDS": "receives", "TASKPRIORITY": "receives",
+      "FACILITY": "receives", "TCTUALENG": "receives", "FCI": "receives", "TELLERID": "receives",
+      "GCHARS": "receives", "TERMCODE": "receives", "GCODES": "receives", "TERMPRIORITY": "receives",
+      "GMMI": "receives", "TEXTKYBD": "receives", "HILIGHT": "receives", "TEXTPRINT": "receives",
+      "INITPARM": "receives", "TRANPRIORITY": "receives", "INITPARMLEN": "receives",
+      "TWALENG": "receives", "INPARTN": "receives", "UNATTEND": "receives", "INPUTMSGLEN": "receives",
+      "USERID": "receives", "INVOKINGPROG": "receives", "USERNAME": "receives", "KATAKANA": "receives",
+      "USERPRIORITY": "receives", "LANGINUSE": "receives", "VALIDATION": "receives",
+      "LDCMNEM": "receives", "LDCNUM": "receives", "LINKLEVEL": "receives", "MAJORVERSION": "receives",
+      "MAPCOLUMN": "receives", "MAPHEIGHT": "receives",
+    },
+  },
   "BIF DEEDIT": {"identify":["DEEDIT"],"options":{"FIELD":"both","LENGTH":"sends"}},
   "CANCEL": {"options":{"REQID":"sends","SYSID":"sends","TRANSID":"sends"}},
-  "DEFINE COUNTER": {"identify":["COUNTER","DCOUNTER"],"options":{"COUNTER":"sends","POOL":"sends","VALUE":"sends","MINIMUM":"sends","MAXIMUM":"sends"}},
-  "DELAY": {"options":{"INTERVAL":"sends","TIME":"sends","REQID":"sends","HOURS":"sends","MINUTES":"sends","SECONDS":"sends","MILLISECS":"sends"}},
-  "DELETE": {"options":{"FILE":"sends","TOKEN":"sends","RIDFLD":"sends","KEYLENGTH":"sends","NUMREC":"receives","SYSID":"sends"}},
+  "DEFINE COUNTER": {
+    "identify": ["COUNTER","DCOUNTER"],
+    "options": {
+      "COUNTER": "sends", "POOL": "sends", "VALUE": "sends", "MINIMUM": "sends", "MAXIMUM": "sends",
+    },
+  },
+  "DELAY": {
+    "options": {
+      "INTERVAL": "sends", "TIME": "sends", "REQID": "sends", "HOURS": "sends", "MINUTES": "sends",
+      "SECONDS": "sends", "MILLISECS": "sends",
+    },
+  },
+  "DELETE": {
+    "options": {
+      "FILE": "sends", "TOKEN": "sends", "RIDFLD": "sends", "KEYLENGTH": "sends", "NUMREC": "receives",
+      "SYSID": "sends",
+    },
+  },
   "DELETE CONTAINER": {"identify":["CONTAINER"],"options":{"CONTAINER":"sends","CHANNEL":"sends"}},
-  "DELETE COUNTER": {"identify":["COUNTER","DCOUNTER"],"options":{"COUNTER":"sends","POOL":"sends"}},
+  "DELETE COUNTER": {
+    "identify": ["COUNTER","DCOUNTER"],
+    "options": {
+      "COUNTER": "sends", "POOL": "sends",
+    },
+  },
   "DELETEQ TD": {"identify":["TD"],"options":{"QUEUE":"sends","SYSID":"sends"}},
-  "DELETEQ TS": {"identify":["TS"],"default":true,"options":{"QUEUE":"sends","QNAME":"sends","SYSID":"sends"}},
+  "DELETEQ TS": {
+    "identify": ["TS"],
+    "default": true,
+    "options": {
+      "QUEUE": "sends", "QNAME": "sends", "SYSID": "sends",
+    },
+  },
   "DEQ": {"options":{"RESOURCE":"sends","LENGTH":"sends","MAXLIFETIME":"sends"}},
-  "DUMP TRANSACTION": {"identify":["TRANSACTION"],"options":{"DUMPCODE":"sends","FROM":"sends","LENGTH":"sends","FLENGTH":"sends","SEGMENTLIST":"sends","LENGTHLIST":"sends","NUMSEGMENTS":"sends","DUMPID":"receives"}},
+  "DUMP TRANSACTION": {
+    "identify": ["TRANSACTION"],
+    "options": {
+      "DUMPCODE": "sends", "FROM": "sends", "LENGTH": "sends", "FLENGTH": "sends",
+      "SEGMENTLIST": "sends", "LENGTHLIST": "sends", "NUMSEGMENTS": "sends", "DUMPID": "receives",
+    },
+  },
   "ENDBR": {"options":{"FILE":"sends","REQID":"sends","SYSID":"sends"}},
   "ENQ": {"options":{"RESOURCE":"sends","LENGTH":"sends","MAXLIFETIME":"sends"}},
-  "ENTER TRACENUM": {"identify":["TRACENUM"],"options":{"TRACENUM":"sends","FROM":"sends","RESOURCE":"sends","FROMLENGTH":"sends"}},
-  "FORMATTIME": {"options":{"DATESTRING":"receives","ABSTIME":"sends","DATE":"receives","FULLDATE":"receives","DATEFORM":"receives","DATESEP":"sends","DAYCOUNT":"receives","STRINGZONE":"sends","DAYOFMONTH":"receives","DAYOFWEEK":"receives","DDMMYY":"receives","DDMMYYYY":"receives","MILLISECONDS":"receives","MMDDYY":"receives","MMDDYYYY":"receives","MONTHOFYEAR":"receives","STRINGFORMAT":"sends","TIME":"receives","YEAR":"receives","YYDDD":"receives","TIMESEP":"sends","YYDDMM":"receives","YYMMDD":"receives","YYYYDDD":"receives","YYYYDDMM":"receives","YYYYMMDD":"receives"}},
+  "ENTER TRACENUM": {
+    "identify": ["TRACENUM"],
+    "options": {
+      "TRACENUM": "sends", "FROM": "sends", "RESOURCE": "sends", "FROMLENGTH": "sends",
+    },
+  },
+  "FORMATTIME": {
+    "options": {
+      "DATESTRING": "receives", "ABSTIME": "sends", "DATE": "receives", "FULLDATE": "receives",
+      "DATEFORM": "receives", "DATESEP": "sends", "DAYCOUNT": "receives", "STRINGZONE": "sends",
+      "DAYOFMONTH": "receives", "DAYOFWEEK": "receives", "DDMMYY": "receives", "DDMMYYYY": "receives",
+      "MILLISECONDS": "receives", "MMDDYY": "receives", "MMDDYYYY": "receives",
+      "MONTHOFYEAR": "receives", "STRINGFORMAT": "sends", "TIME": "receives", "YEAR": "receives",
+      "YYDDD": "receives", "TIMESEP": "sends", "YYDDMM": "receives", "YYMMDD": "receives",
+      "YYYYDDD": "receives", "YYYYDDMM": "receives", "YYYYMMDD": "receives",
+    },
+  },
   "FREEMAIN": {"options":{"DATA":"sends","DATAPOINTER":"sends"}},
-  "GET CONTAINER": {"identify":["CONTAINER"],"options":{"CONTAINER":"sends","CHANNEL":"sends","INTO":"receives","FLENGTH":"both","SET":"receives","BYTEOFFSET":"sends","INTOCCSID":"sends","INTOCODEPAGE":"sends","CONVERTST":"sends","CCSID":"receives"}},
-  "GET COUNTER": {"identify":["COUNTER","DCOUNTER"],"options":{"COUNTER":"sends","VALUE":"receives","POOL":"sends","INCREMENT":"sends","COMPAREMIN":"sends","COMPAREMAX":"sends"}},
+  "GET CONTAINER": {
+    "identify": ["CONTAINER"],
+    "options": {
+      "CONTAINER": "sends", "CHANNEL": "sends", "INTO": "receives", "FLENGTH": "both",
+      "SET": "receives", "BYTEOFFSET": "sends", "INTOCCSID": "sends", "INTOCODEPAGE": "sends",
+      "CONVERTST": "sends", "CCSID": "receives",
+    },
+  },
+  "GET COUNTER": {
+    "identify": ["COUNTER","DCOUNTER"],
+    "options": {
+      "COUNTER": "sends", "VALUE": "receives", "POOL": "sends", "INCREMENT": "sends",
+      "COMPAREMIN": "sends", "COMPAREMAX": "sends",
+    },
+  },
   "GETMAIN": {"options":{"SET":"receives","FLENGTH":"sends","LENGTH":"sends","INITIMG":"sends"}},
   "HANDLE ABEND": {"identify":["ABEND"],"options":{"PROGRAM":"sends","LABEL":"label"}},
   "HANDLE AID": {"identify":["AID"],"anyOption":"label","options":{}},
   "HANDLE CONDITION": {"identify":["CONDITION"],"anyOption":"label","options":{}},
   "IGNORE CONDITION": {"identify":["CONDITION"],"anyOption":"none","options":{}},
-  "LINK": {"options":{"PROGRAM":"sends","COMMAREA":"both","CHANNEL":"sends","LENGTH":"sends","DATALENGTH":"sends","INPUTMSG":"sends","INPUTMSGLEN":"sends","SYSID":"sends","TRANSID":"sends"}},
-  "LOAD": {"options":{"PROGRAM":"sends","SET":"receives","LENGTH":"receives","FLENGTH":"receives","ENTRY":"receives"}},
+  "LINK": {
+    "options": {
+      "PROGRAM": "sends", "COMMAREA": "both", "CHANNEL": "sends", "LENGTH": "sends",
+      "DATALENGTH": "sends", "INPUTMSG": "sends", "INPUTMSGLEN": "sends", "SYSID": "sends",
+      "TRANSID": "sends",
+    },
+  },
+  "LOAD": {
+    "options": {
+      "PROGRAM": "sends", "SET": "receives", "LENGTH": "receives", "FLENGTH": "receives",
+      "ENTRY": "receives",
+    },
+  },
   "POP HANDLE": {"identify":["HANDLE"],"options":{}},
   "PURGE MESSAGE": {"identify":["MESSAGE"],"options":{}},
   "PUSH HANDLE": {"identify":["HANDLE"],"options":{}},
-  "PUT CONTAINER": {"identify":["CONTAINER"],"options":{"CONTAINER":"sends","FROM":"sends","CHANNEL":"sends","FLENGTH":"sends","DATATYPE":"sends","FROMCCSID":"sends","FROMCODEPAGE":"sends"}},
-  "QUERY COUNTER": {"identify":["COUNTER","DCOUNTER"],"options":{"COUNTER":"sends","POOL":"sends","VALUE":"receives","MINIMUM":"receives","MAXIMUM":"receives"}},
-  "READ": {"options":{"FILE":"sends","INTO":"receives","SET":"receives","TOKEN":"receives","RIDFLD":"both","KEYLENGTH":"sends","SYSID":"sends","LENGTH":"both"}},
-  "READNEXT": {"options":{"FILE":"sends","INTO":"receives","SET":"receives","TOKEN":"receives","RIDFLD":"both","KEYLENGTH":"sends","REQID":"sends","SYSID":"sends","LENGTH":"both"}},
-  "READPREV": {"options":{"FILE":"sends","INTO":"receives","SET":"receives","TOKEN":"receives","RIDFLD":"both","KEYLENGTH":"sends","REQID":"sends","LENGTH":"both","SYSID":"sends"}},
-  "READQ TD": {"identify":["TD"],"options":{"QUEUE":"sends","INTO":"receives","SET":"receives","LENGTH":"both","SYSID":"sends"}},
-  "READQ TS": {"identify":["TS"],"default":true,"options":{"QUEUE":"sends","QNAME":"sends","INTO":"receives","SET":"receives","LENGTH":"both","NUMITEMS":"receives","ITEM":"sends","SYSID":"sends"}},
-  "RECEIVE": {"options":{"INTO":"receives","SET":"receives","LENGTH":"both","FLENGTH":"both","MAXLENGTH":"sends","MAXFLENGTH":"sends"}},
-  "RECEIVE MAP": {"identify":["MAP"],"options":{"MAP":"sends","MAPSET":"sends","INTO":"receives","SET":"receives","FROM":"sends","LENGTH":"sends","INPARTN":"sends"},"defaults":{"INTO":{"name":"MAP","suffix":"I","unless":["SET"]}}},
+  "PUT CONTAINER": {
+    "identify": ["CONTAINER"],
+    "options": {
+      "CONTAINER": "sends", "FROM": "sends", "CHANNEL": "sends", "FLENGTH": "sends",
+      "DATATYPE": "sends", "FROMCCSID": "sends", "FROMCODEPAGE": "sends",
+    },
+  },
+  "QUERY COUNTER": {
+    "identify": ["COUNTER","DCOUNTER"],
+    "options": {
+      "COUNTER": "sends", "POOL": "sends", "VALUE": "receives", "MINIMUM": "receives",
+      "MAXIMUM": "receives",
+    },
+  },
+  "READ": {
+    "options": {
+      "FILE": "sends", "INTO": "receives", "SET": "receives", "TOKEN": "receives", "RIDFLD": "both",
+      "KEYLENGTH": "sends", "SYSID": "sends", "LENGTH": "both",
+    },
+  },
+  "READNEXT": {
+    "options": {
+      "FILE": "sends", "INTO": "receives", "SET": "receives", "TOKEN": "receives", "RIDFLD": "both",
+      "KEYLENGTH": "sends", "REQID": "sends", "SYSID": "sends", "LENGTH": "both",
+    },
+  },
+  "READPREV": {
+    "options": {
+      "FILE": "sends", "INTO": "receives", "SET": "receives", "TOKEN": "receives", "RIDFLD": "both",
+      "KEYLENGTH": "sends", "REQID": "sends", "LENGTH": "both", "SYSID": "sends",
+    },
+  },
+  "READQ TD": {
+    "identify": ["TD"],
+    "options": {
+      "QUEUE": "sends", "INTO": "receives", "SET": "receives", "LENGTH": "both", "SYSID": "sends",
+    },
+  },
+  "READQ TS": {
+    "identify": ["TS"],
+    "default": true,
+    "options": {
+      "QUEUE": "sends", "QNAME": "sends", "INTO": "receives", "SET": "receives", "LENGTH": "both",
+      "NUMITEMS": "receives", "ITEM": "sends", "SYSID": "sends",
+    },
+  },
+  "RECEIVE": {
+    "options": {
+      "INTO": "receives", "SET": "receives", "LENGTH": "both", "FLENGTH": "both", "MAXLENGTH": "sends",
+      "MAXFLENGTH": "sends",
+    },
+  },
+  "RECEIVE MAP": {
+    "identify": ["MAP"],
+    "options": {
+      "MAP": "sends", "MAPSET": "sends", "INTO": "receives", "SET": "receives", "FROM": "sends",
+      "LENGTH": "sends", "INPARTN": "sends",
+    },
+    "defaults": {"INTO":{"name":"MAP","suffix":"I","unless":["SET"]}},
+  },
   "RELEASE": {"options":{"PROGRAM":"sends"}},
-  "RESETBR": {"options":{"FILE":"sends","RIDFLD":"sends","KEYLENGTH":"sends","REQID":"sends","SYSID":"sends"}},
-  "RETRIEVE": {"options":{"INTO":"receives","SET":"receives","LENGTH":"both","RTRANSID":"receives","RTERMID":"receives","QUEUE":"receives"}},
-  "RETURN": {"options":{"TRANSID":"sends","COMMAREA":"sends","LENGTH":"sends","CHANNEL":"sends","INPUTMSG":"sends","INPUTMSGLEN":"sends"}},
-  "REWIND COUNTER": {"identify":["COUNTER","DCOUNTER"],"options":{"COUNTER":"sends","POOL":"sends","INCREMENT":"sends"}},
-  "REWRITE": {"options":{"FILE":"sends","FROM":"sends","TOKEN":"sends","SYSID":"sends","LENGTH":"sends"}},
+  "RESETBR": {
+    "options": {
+      "FILE": "sends", "RIDFLD": "sends", "KEYLENGTH": "sends", "REQID": "sends", "SYSID": "sends",
+    },
+  },
+  "RETRIEVE": {
+    "options": {
+      "INTO": "receives", "SET": "receives", "LENGTH": "both", "RTRANSID": "receives",
+      "RTERMID": "receives", "QUEUE": "receives",
+    },
+  },
+  "RETURN": {
+    "options": {
+      "TRANSID": "sends", "COMMAREA": "sends", "LENGTH": "sends", "CHANNEL": "sends",
+      "INPUTMSG": "sends", "INPUTMSGLEN": "sends",
+    },
+  },
+  "REWIND COUNTER": {
+    "identify": ["COUNTER","DCOUNTER"],
+    "options": {
+      "COUNTER": "sends", "POOL": "sends", "INCREMENT": "sends",
+    },
+  },
+  "REWRITE": {
+    "options": {
+      "FILE": "sends", "FROM": "sends", "TOKEN": "sends", "SYSID": "sends", "LENGTH": "sends",
+    },
+  },
   "SEND": {"options":{"FROM":"sends","LENGTH":"sends","FLENGTH":"sends"}},
-  "SEND CONTROL": {"identify":["CONTROL"],"options":{"CURSOR":"sends","MSR":"sends","OUTPARTN":"sends","ACTPARTN":"sends","LDC":"sends","SET":"receives","REQID":"sends"}},
-  "SEND MAP": {"identify":["MAP"],"options":{"MAP":"sends","MAPSET":"sends","FROM":"sends","LENGTH":"sends","MSR":"sends","FMHPARM":"sends","OUTPARTN":"sends","ACTPARTN":"sends","LDC":"sends","SET":"receives","REQID":"sends","CURSOR":"sends"},"defaults":{"FROM":{"name":"MAP","suffix":"O","unless":["MAPONLY"]}}},
-  "SEND PAGE": {"identify":["PAGE"],"options":{"TRANSID":"sends","TRAILER":"sends","SET":"receives","FMHPARM":"sends"}},
-  "SEND TEXT": {"identify":["TEXT"],"options":{"FROM":"sends","LENGTH":"sends","CURSOR":"sends","FMHPARM":"sends","OUTPARTN":"sends","ACTPARTN":"sends","MSR":"sends","LDC":"sends","SET":"receives","REQID":"sends","HEADER":"sends","TRAILER":"sends","JUSTIFY":"sends"}},
+  "SEND CONTROL": {
+    "identify": ["CONTROL"],
+    "options": {
+      "CURSOR": "sends", "MSR": "sends", "OUTPARTN": "sends", "ACTPARTN": "sends", "LDC": "sends",
+      "SET": "receives", "REQID": "sends",
+    },
+  },
+  "SEND MAP": {
+    "identify": ["MAP"],
+    "options": {
+      "MAP": "sends", "MAPSET": "sends", "FROM": "sends", "LENGTH": "sends", "MSR": "sends",
+      "FMHPARM": "sends", "OUTPARTN": "sends", "ACTPARTN": "sends", "LDC": "sends", "SET": "receives",
+      "REQID": "sends", "CURSOR": "sends",
+    },
+    "defaults": {"FROM":{"name":"MAP","suffix":"O","unless":["MAPONLY"]}},
+  },
+  "SEND PAGE": {
+    "identify": ["PAGE"],
+    "options": {
+      "TRANSID": "sends", "TRAILER": "sends", "SET": "receives", "FMHPARM": "sends",
+    },
+  },
+  "SEND TEXT": {
+    "identify": ["TEXT"],
+    "options": {
+      "FROM": "sends", "LENGTH": "sends", "CURSOR": "sends", "FMHPARM": "sends", "OUTPARTN": "sends",
+      "ACTPARTN": "sends", "MSR": "sends", "LDC": "sends", "SET": "receives", "REQID": "sends",
+      "HEADER": "sends", "TRAILER": "sends", "JUSTIFY": "sends",
+    },
+  },
   "SIGNOFF": {"options":{}},
-  "SIGNON": {"options":{"USERID":"sends","ESMREASON":"receives","ESMRESP":"receives","GROUPID":"sends","LANGUAGECODE":"sends","NATLANG":"sends","LANGINUSE":"receives","NATLANGINUSE":"receives","PASSWORD":"sends","NEWPASSWORD":"sends","PHRASE":"sends","PHRASELEN":"sends","NEWPHRASE":"sends","NEWPHRASELEN":"sends","OIDCARD":"sends"}},
-  "START": {"options":{"TRANSID":"sends","INTERVAL":"sends","TIME":"sends","REQID":"sends","HOURS":"sends","MINUTES":"sends","SECONDS":"sends","FROM":"sends","LENGTH":"sends","TERMID":"sends","USERID":"sends","SYSID":"sends","RTRANSID":"sends","RTERMID":"sends","QUEUE":"sends"}},
-  "STARTBR": {"options":{"FILE":"sends","RIDFLD":"sends","KEYLENGTH":"sends","REQID":"sends","SYSID":"sends"}},
+  "SIGNON": {
+    "options": {
+      "USERID": "sends", "ESMREASON": "receives", "ESMRESP": "receives", "GROUPID": "sends",
+      "LANGUAGECODE": "sends", "NATLANG": "sends", "LANGINUSE": "receives", "NATLANGINUSE": "receives",
+      "PASSWORD": "sends", "NEWPASSWORD": "sends", "PHRASE": "sends", "PHRASELEN": "sends",
+      "NEWPHRASE": "sends", "NEWPHRASELEN": "sends", "OIDCARD": "sends",
+    },
+  },
+  "START": {
+    "options": {
+      "TRANSID": "sends", "INTERVAL": "sends", "TIME": "sends", "REQID": "sends", "HOURS": "sends",
+      "MINUTES": "sends", "SECONDS": "sends", "FROM": "sends", "LENGTH": "sends", "TERMID": "sends",
+      "USERID": "sends", "SYSID": "sends", "RTRANSID": "sends", "RTERMID": "sends", "QUEUE": "sends",
+    },
+  },
+  "STARTBR": {
+    "options": {
+      "FILE": "sends", "RIDFLD": "sends", "KEYLENGTH": "sends", "REQID": "sends", "SYSID": "sends",
+    },
+  },
   "SYNCPOINT": {"options":{}},
   "SYNCPOINT ROLLBACK": {"identify":["ROLLBACK"],"options":{}},
   "UNLOCK": {"options":{"FILE":"sends","TOKEN":"sends","SYSID":"sends"}},
-  "UPDATE COUNTER": {"identify":["COUNTER","DCOUNTER"],"options":{"COUNTER":"sends","VALUE":"sends","POOL":"sends","COMPAREMIN":"sends","COMPAREMAX":"sends"}},
-  "WRITE": {"options":{"FILE":"sends","FROM":"sends","RIDFLD":"both","KEYLENGTH":"sends","SYSID":"sends","LENGTH":"sends"}},
-  "WRITE JOURNALNAME": {"identify":["JOURNALNAME"],"options":{"JOURNALNAME":"sends","JTYPEID":"sends","FROM":"sends","FLENGTH":"sends","REQID":"receives","PREFIX":"sends","PFXLENG":"sends"}},
-  "WRITE OPERATOR": {"identify":["OPERATOR"],"options":{"TEXT":"sends","TEXTLENGTH":"sends","ROUTECODES":"sends","NUMROUTES":"sends","ACTION":"sends","REPLY":"receives","MAXLENGTH":"sends","REPLYLENGTH":"receives","TIMEOUT":"sends"}},
-  "WRITEQ TD": {"identify":["TD"],"options":{"QUEUE":"sends","FROM":"sends","LENGTH":"sends","SYSID":"sends"}},
-  "WRITEQ TS": {"identify":["TS"],"default":true,"options":{"QUEUE":"sends","QNAME":"sends","FROM":"sends","LENGTH":"sends","NUMITEMS":"receives","ITEM":"both","SYSID":"sends"}},
-  "XCTL": {"options":{"PROGRAM":"sends","COMMAREA":"sends","CHANNEL":"sends","LENGTH":"sends","INPUTMSG":"sends","INPUTMSGLEN":"sends"}},
+  "UPDATE COUNTER": {
+    "identify": ["COUNTER","DCOUNTER"],
+    "options": {
+      "COUNTER": "sends", "VALUE": "sends", "POOL": "sends", "COMPAREMIN": "sends",
+      "COMPAREMAX": "sends",
+    },
+  },
+  "WRITE": {
+    "options": {
+      "FILE": "sends", "FROM": "sends", "RIDFLD": "both", "KEYLENGTH": "sends", "SYSID": "sends",
+      "LENGTH": "sends",
+    },
+  },
+  "WRITE JOURNALNAME": {
+    "identify": ["JOURNALNAME"],
+    "options": {
+      "JOURNALNAME": "sends", "JTYPEID": "sends", "FROM": "sends", "FLENGTH": "sends",
+      "REQID": "receives", "PREFIX": "sends", "PFXLENG": "sends",
+    },
+  },
+  "WRITE OPERATOR": {
+    "identify": ["OPERATOR"],
+    "options": {
+      "TEXT": "sends", "TEXTLENGTH": "sends", "ROUTECODES": "sends", "NUMROUTES": "sends",
+      "ACTION": "sends", "REPLY": "receives", "MAXLENGTH": "sends", "REPLYLENGTH": "receives",
+      "TIMEOUT": "sends",
+    },
+  },
+  "WRITEQ TD": {
+    "identify": ["TD"],
+    "options": {
+      "QUEUE": "sends", "FROM": "sends", "LENGTH": "sends", "SYSID": "sends",
+    },
+  },
+  "WRITEQ TS": {
+    "identify": ["TS"],
+    "default": true,
+    "options": {
+      "QUEUE": "sends", "QNAME": "sends", "FROM": "sends", "LENGTH": "sends", "NUMITEMS": "receives",
+      "ITEM": "both", "SYSID": "sends",
+    },
+  },
+  "XCTL": {
+    "options": {
+      "PROGRAM": "sends", "COMMAREA": "sends", "CHANNEL": "sends", "LENGTH": "sends",
+      "INPUTMSG": "sends", "INPUTMSGLEN": "sends",
+    },
+  },
 };
 
 // Options any command may carry.

package/lib/consequence.mjs

@@ -118,6 +118,25 @@ const RULE_CLASSES = {
   'zowe-config-cleartext': [],
   'zowe-mcp-data-marking-off': [],
   'zowe-mcp-unpinned': [],
+  // An abend stops the run; an overrun or a protection exception is a write that landed, or would
+  // have landed, where the input chose.
+  'input-causes-abend-s0c7': [],
+  'input-causes-abend': [],
+  'input-causes-abend-s0c4': [MUTATES],
+  'input-causes-abend-subscript-range': [MUTATES],
+  // Key zero or supervisor state is the operating system's authority, taken by the code itself.
+  'hlasm-supervisor-state-change': [ESCALATES],
+  // Nothing says input reaches EX's register, or which address space a cross-memory call reaches:
+  // the linkage tables grant that, and the source does not show them. Severity decides.
+  'hlasm-executes-built-instruction': [],
+  'hlasm-cross-memory-service': [],
+  // Disclosure in transit; severity decides.
+  'web-client-opens-cleartext': [],
+  'web-receive-length-exceeds-area': [MUTATES],
+  // Weak cryptography discloses or lets data be changed undetected; severity decides.
+  'icsf-single-length-des-key': [],
+  'icsf-weak-hash': [],
+  'icsf-fixed-initialization-vector': [],
 };
 
 // Coverage and context assert no defect, so they carry no consequence.