@portll/cobolwork 0.3.0 → 0.5.0

package/lib/sets/abend.mjs

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Abends an input caused, from the runs ironwork's fuzzing harness kept (docs/spec/evidence.md §13.6).
+//
+// A fuzz run is a directory: manifest.json names the program, the inputs and each run that ended in
+// an abend, and evidence/ holds each kept run's hash-chained journal. A finding is reported only
+// where the evidence verifies and the run's own journal records the abend the manifest claims, so
+// the finding rests on a record of the run rather than on the manifest's word.
+import { readFileSync, existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { delimiter, join, posix, basename } from 'node:path';
+import { report } from '../kernel/ruleset.mjs';
+import { verifyEvidence } from '../evidence/verify.mjs';
+
+export const ABEND_RULES = {
+  'input-causes-abend-s0c7': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-20',
+    text: 'An input the program accepts ends its run with a data exception (S0C7)',
+    impact: 'Whoever supplies that input can stop the program at will: a batch step abends and the job behind it does not finish, a transaction abends at the terminal',
+    remedy: 'Test the field with IS NUMERIC, or validate the record, before the arithmetic or MOVE the journal names, and reject the input rather than letting the data exception end the run',
+  },
+  'input-causes-abend-s0c4': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-119',
+    text: 'An input the program accepts ends its run with a protection exception (S0C4)',
+    impact: 'The input made the program address storage it does not own; the same input under another layout can read or overwrite other data before anything stops it',
+    remedy: 'Find the subscript, reference modification, pointer or parameter length the input controls at the line the journal names, and bound it before use',
+  },
+  'input-causes-abend-subscript-range': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-129',
+    text: 'An input the program accepts drives a subscript or reference modification out of range, and the run abends',
+    impact: 'SSRANGE caught the overrun and ended the run; compiled without SSRANGE, as production builds often are, the same input reads or writes storage beside the table or field',
+    remedy: 'Check the index against both ends of the table or field before the statement the journal names, and keep SSRANGE on for the build',
+  },
+  'input-causes-abend': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-248',
+    text: 'An input the program accepts ends its run with an abend',
+    impact: 'Whoever supplies that input can stop the program at will, and the abend code says what the program failed to handle',
+    remedy: 'Read the abend code and the line the journal names, and handle the condition the input raises before it ends the run',
+  },
+};
+
+// IBM's messages for an SSRANGE failure: a subscript or index, an OCCURS DEPENDING ON object, and a
+// reference modification's start, length, and start plus length.
+const RANGE_MESSAGES = /^IGZ00(06|07|72|73|74)S\b/;
+
+export function abendRunPaths(opts = {}) {
+  if (opts.abendRuns) return opts.abendRuns;
+  return (process.env.COBOLWORK_ABENDS || '').split(delimiter).filter(Boolean);
+}
+
+export function abendRule(abend) {
+  if (abend.code === 'S0C7') return 'input-causes-abend-s0c7';
+  if (abend.code === 'S0C4') return 'input-causes-abend-s0c4';
+  if (RANGE_MESSAGES.test(abend.message || '')) return 'input-causes-abend-subscript-range';
+  return 'input-causes-abend';
+}
+
+// The abend a kept run's own journal records, with the sources it read and the programs it CALLed,
+// or null.
+function journalAbend(evidenceDir, runId) {
+  if (typeof runId !== 'string' || !/^[0-9TZ]+-[0-9a-f]{16}$/.test(runId)) return null;
+  const file = join(evidenceDir, 'runs', `${runId}.jsonl`);
+  if (!existsSync(file)) return null;
+  let abend = null;
+  const inputs = [];
+  const calls = [];
+  for (const line of readFileSync(file, 'utf8').split('\n')) {
+    if (!line) continue;
+    const rec = JSON.parse(line);
+    if (rec.kind === 'abend') abend ??= rec;
+    else if (rec.kind === 'input') inputs.push(rec);
+    else if (rec.kind === 'call') calls.push(rec);
+  }
+  return abend && { ...abend, inputs, calls };
+}
+
+const isString = (x) => typeof x === 'string' && x.length > 0;
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+// A manifest root as a directory of the scanned tree, or null when it is not one.
+function treeDir(dir) {
+  if (typeof dir !== 'string') return null;
+  const norm = posix.normalize(dir.replace(/\\/g, '/'));
+  return norm === '..' || norm.startsWith('../') || posix.isAbsolute(norm) ? null : norm;
+}
+
+// The directory in the scanned tree of the root the run read `file` from, located by the manifest's
+// roots: the root the journal's input record for that file names, or for a CALLed program's source,
+// which its call record names by path and digest alone, the root under which the tree holds that
+// file with that digest. Undefined where neither record names the file, null where the root cannot
+// be told or lies outside the tree.
+function rootDirectory(roots, journal, file, tree) {
+  if (!Array.isArray(roots)) return undefined;
+  const held = [...new Set(journal.inputs.filter((i) => i.path === file && Number.isInteger(i.root)).map((i) => i.root))];
+  if (held.length) return held.length === 1 ? treeDir(roots[held[0]]) : null;
+  const digests = new Set(journal.calls.filter((c) => c.from === file).map((c) => c.sha256));
+  if (!digests.size || !tree) return undefined;
+  const holding = [...new Set(roots.map(treeDir).filter((d) => d !== null && existsSync(join(tree, d, file))))];
+  const same = holding.filter((d) => digests.has(sha256(readFileSync(join(tree, d, file)))));
+  const found = same.length ? same : holding;
+  return found.length === 1 ? found[0] : null;
+}
+
+// One fuzz run: its findings, and what kept any of it from counting. `tree` is the scanned tree,
+// where a CALLed program's source is looked for.
+export function loadAbendRun(dir, tree) {
+  const out = { dir: basename(dir), program: null, findings: [], problems: [], counts: null, notModelled: 0 };
+  let doc;
+  try { doc = JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')); } catch (e) {
+    out.problems.push(e.code ? `manifest.json could not be read (${e.code})` : `manifest.json is not JSON (${e.message})`);
+    return out;
+  }
+  if (!doc || doc.tool !== 'ironwork-fuzz' || !doc.program || !isString(doc.program.file) || !Array.isArray(doc.inputs) || !Array.isArray(doc.runs)) {
+    out.problems.push('manifest.json is not an ironwork-fuzz manifest with a program, inputs and runs');
+    return out;
+  }
+  const programFile = posix.normalize(doc.program.file.replace(/\\/g, '/'));
+  if (programFile.startsWith('../') || posix.isAbsolute(programFile)) {
+    out.problems.push(`the program ${doc.program.file} is outside the scanned tree`);
+    return out;
+  }
+  out.program = { file: programFile, id: isString(doc.program.id) ? doc.program.id : null };
+  out.counts = doc.counts && typeof doc.counts === 'object' ? doc.counts : null;
+
+  const evidenceDir = join(dir, 'evidence');
+  const verdict = verifyEvidence(evidenceDir);
+  if (!verdict.verified) {
+    out.problems.push(`its evidence does not verify: ${verdict.broken.map((b) => `${b.file}:${b.line} ${b.check}`).join(', ') || 'nothing is recorded'}`);
+    return out;
+  }
+  const inputs = new Map(doc.inputs.filter((i) => i && isString(i.id)).map((i) => [i.id, i]));
+  const seen = new Map();
+  for (const run of doc.runs) {
+    if (!run || run.outcome !== 'abend' || !run.abend || !isString(run.abend.code)) continue;
+    if (run.abend.code === 'IRONWORK') { out.notModelled++; continue; }
+    const recorded = journalAbend(evidenceDir, run.journal);
+    if (!recorded || recorded.code !== run.abend.code) {
+      out.problems.push(`run ${run.journal ?? '(unnamed)'}: its journal does not record the abend ${run.abend.code} the manifest gives`);
+      continue;
+    }
+    // Where the journal names the abend's place, that is the place, and a manifest that says otherwise is not believed.
+    const claimed = { file: run.abend.file, line: run.abend.line };
+    const place = isString(recorded.file) && Number.isInteger(recorded.line) ? { file: recorded.file, line: recorded.line } : claimed;
+    if (place !== claimed && ((isString(claimed.file) && claimed.file !== place.file) || (claimed.line != null && claimed.line !== place.line))) {
+      out.problems.push(`run ${run.journal}: its journal records the abend at ${place.file}:${place.line}, not where the manifest puts it`);
+      continue;
+    }
+    const rootDir = isString(place.file) ? rootDirectory(doc.roots, recorded, place.file, tree) : undefined;
+    if (rootDir === null) {
+      out.problems.push(`run ${run.journal}: the abend is in ${place.file}, which its journal and manifest do not place in the scanned tree`);
+      continue;
+    }
+    const where = isString(place.file) ? posix.normalize(posix.join(rootDir ?? posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
+    const line = Number.isInteger(place.line) && place.line > 0 ? place.line : 1;
+    const rule = abendRule(run.abend);
+    const used = (Array.isArray(run.input) ? run.input : []).map((id) => inputs.get(id)).filter(Boolean)
+      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}) }));
+    const key = `${rule}|${where}|${line}`;
+    const size = used.reduce((n, i) => n + String(i.bytes || '').length, 0);
+    const held = seen.get(key);
+    if (held && held.size <= size) continue;
+    const finding = {
+      rule, path: where, line, program: out.program.id,
+      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept`,
+      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}) },
+      input: used, run: { dir: out.dir, journal: run.journal },
+    };
+    seen.set(key, { size, finding });
+  }
+  out.findings = [...seen.values()].map((s) => s.finding);
+  return out;
+}
+
+export function scanAbend(root, opts = {}) {
+  const dirs = abendRunPaths(opts);
+  const runs = dirs.map((d) => loadAbendRun(d, root));
+  const findings = runs.flatMap((r) => r.findings.filter((f) => existsSync(join(root, f.path))));
+  const stats = {
+    filesScanned: 0, filesUnreadable: 0,
+    abendRuns: runs.map((r) => ({ dir: r.dir, program: r.program ? r.program.file : null, findings: r.findings.length, ...(r.notModelled ? { notModelled: r.notModelled } : {}), ...(r.counts ? { counts: r.counts } : {}) })),
+    ...(runs.some((r) => r.problems.length) ? { abendRunProblems: runs.flatMap((r) => r.problems.map((p) => `${r.dir}: ${p}`)) } : {}),
+    ...(runs.some((r) => r.findings.some((f) => !existsSync(join(root, f.path)))) ? { abendRunsElsewhere: runs.flatMap((r) => r.findings.filter((f) => !existsSync(join(root, f.path))).map((f) => `${r.dir}: ${f.path}`)) } : {}),
+    setIncomplete: runs.some((r) => r.problems.length > 0),
+  };
+  return report('abend', { rules: ABEND_RULES, findings, stats, run: null });
+}
+

package/lib/sets/compile.mjs

@@ -93,7 +93,8 @@ function declaredIn(text, names, into) {
 // A reference cut at column 72 names a word the source does not hold.
 function truncated(ref, lines) {
   const line = (lines.get(ref.file) || [])[ref.line - 1] || '';
-  const re = new RegExp(`(?<![A-Za-z0-9-])${ref.name.replace(/[$#@]/g, '\\$&')}`, 'gi');
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- the name is escaped
+  const re = new RegExp(`(?<![A-Za-z0-9-])${ref.name.replace(/[.*+?^${}()|[\]\\#@]/g, '\\$&')}`, 'gi');
   let whole = false;
   let any = false;
   let m;

package/lib/sets/crypto.mjs

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// What a program asks ICSF for. A COBOL program reaches z/OS cryptography by CALLing an ICSF
+// callable service with positional arguments, and the strength it gets is in those arguments: the
+// key length it generates, the hash it names in a rule array, the initialization vector it passes.
+// rules/icsf-services.json holds each service's parameters in order, from IBM's manual, and which
+// keywords each rule reports and why.
+//
+// An argument is judged by the literals that can reach it (lib/constants.mjs). One a computation, a
+// read or another program fills is not judged, and is counted as undecided rather than passed.
+import { readFileSync } from 'node:fs';
+import { inScope, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { constantsReaching, keywordsOf } from '../constants.mjs';
+
+const TABLE = JSON.parse(readFileSync(new URL('../../rules/icsf-services.json', import.meta.url), 'utf8'));
+
+export const CRYPTO_RULES = {
+  'icsf-single-length-des-key': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-327',
+    text: 'A program generates a single-length DES key through ICSF',
+    impact: 'The key is 56 bits, which exhaustive search recovers, and every later encipher with it runs single DES, so the data it protects is readable by anyone who takes the ciphertext',
+    remedy: 'Generate an AES key (key_type_1 AESDATA with KEYLN16 or longer, or CSNBKGN2) and encipher with CSNBSAE or CSNBSYE and AES',
+  },
+  'icsf-weak-hash': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-328',
+    text: 'A program hashes with MD5 or SHA-1 through ICSF',
+    impact: 'Collisions are practical for both, so a digest no longer shows the text was not changed, and an MD5 or SHA-1 of a password is quick to reverse for a short one',
+    remedy: 'Name SHA-256 or longer in the rule array, or BCRYPT for a password',
+  },
+  'icsf-fixed-initialization-vector': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-1204',
+    text: 'A program enciphers through ICSF with an initialization vector that never changes',
+    impact: 'Equal messages encipher to equal ciphertext, and under CUSP or IPS a message shorter than a block is XORed with the same keystream every time, so whoever sees the ciphertexts learns which are equal and can recover short ones',
+    remedy: 'Pass a vector generated for each message (CSNBRNG, or CSNBRNGL) and send it with the ciphertext',
+  },
+};
+
+// Every name a service answers to, 31- and 64-bit, CSF and ALET forms, to its entry.
+const SERVICES = new Map();
+for (const s of TABLE.services) {
+  const a = s.entry_points || {};
+  const names = [s.name, ...(a['31-bit'] || []), ...(a['64-bit'] || []), ...((a.alet && a.alet['31-bit']) || []), ...((a.alet && a.alet['64-bit']) || [])];
+  for (const n of names) SERVICES.set(n.toUpperCase(), s);
+}
+const F = TABLE.findings;
+const ruleFor = { 'single-length-des-key': 'icsf-single-length-des-key', 'weak-hash': 'icsf-weak-hash' };
+const isIcsf = (c) => SERVICES.has(String(c.name || '').toUpperCase());
+
+const argument = (call, service, parameter) => {
+  const i = service.parameters.indexOf(parameter);
+  return i >= 0 && call.using[i] && call.using[i].word ? call.using[i].word : null;
+};
+const shown = (values) => [...new Set(values.map((v) => (/^[A-Z-]+$/.test(v) ? v : `'${v.trim()}'`)))].join(', ');
+
+export function scanCrypto(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(isProgram).filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0, icsfCalls: 0, argumentsUndecided: 0 };
+
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    if (!/CALL\s+['"]?CS[NF]/i.test(src)) return src.length;
+    let r;
+    try { r = tree.parse(f, src); } catch (e) { noteUnparsed(stats, tree, f, e); return src.length; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const p of r.programs) {
+      for (const c of p.calls || []) {
+        const service = SERVICES.get(String(c.name || '').toUpperCase());
+        if (!service || c.kind !== 'L') continue;
+        stats.icsfCalls++;
+        const at = { path: c.file ? relPath(root, c.file) : path, line: c.line || 1, program: p.id };
+        const read = (parameter) => {
+          const name = argument(c, service, parameter);
+          if (!name) return null;
+          const got = constantsReaching(p, name, { ignoreCall: isIcsf });
+          return { name, ...got, keywords: keywordsOf(got.values) };
+        };
+
+        for (const [key, rule] of Object.entries(ruleFor)) {
+          const fd = F[key];
+          if (!fd.services.includes(service.name)) continue;
+          const arg = read(fd.parameter);
+          if (!arg) continue;
+          const weak = fd.keywords.filter((k) => arg.keywords.has(k));
+          if (!weak.length) { if (arg.open || !arg.values.length) stats.argumentsUndecided++; continue; }
+          findings.push({ rule, ...at,
+            detail: `CALL '${c.name}' passes ${arg.name} as ${fd.parameter}, and ${arg.name} can hold ${weak.join(' or ')}` });
+        }
+
+        const iv = F['fixed-initialization-vector'];
+        if (!iv.services.includes(service.name)) continue;
+        const rules = read('rule_array');
+        if (rules && iv.withoutVector.some((k) => rules.keywords.has(k))) continue;
+        const vector = read(iv.parameter);
+        if (!vector) continue;
+        if (vector.open || !vector.values.length) { stats.argumentsUndecided++; continue; }
+        findings.push({ rule: 'icsf-fixed-initialization-vector', ...at,
+          detail: `CALL '${c.name}' passes ${vector.name} as its initialization vector, and nothing but ${shown(vector.values)} is ever put in it` });
+      }
+    }
+    return src.length;
+  }, { label: 'crypto', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  return report('crypto', { rules: CRYPTO_RULES, findings, stats, run });
+}

package/lib/sets/flow.mjs

@@ -349,6 +349,21 @@ const DEFAULT = { sev: 'med', evidence: 'path', cwe: null, text: 'Untrusted inpu
 // is safe for the sink - one of a list of literals, digits where digits are needed, a bound where an
 // index is - is not a finding at all, and is listed under `checked` with the check that stops it.
 const LOWER = { crit: 'high', high: 'med', med: 'low', low: 'info', info: 'info' };
+
+// The routes of two sources that reach one sink, as one finding carries them: every source, every
+// statement either route runs, and complete only where both are.
+const routeKey = (s) => `${s.file}:${s.line}:${s.verb ?? s.kind}`;
+function mergeRoutes(a, b) {
+  const union = (x, y) => [...new Map([...x, ...y].map((s) => [routeKey(s), s])).values()];
+  const order = (p, q) => (p.file < q.file ? -1 : p.file > q.file ? 1 : p.line - q.line);
+  const unplaced = (a.unplaced || 0) + (b.unplaced || 0);
+  return {
+    sources: union(a.sources, b.sources).sort(order),
+    statements: union(a.statements, b.statements).sort(order),
+    ...(unplaced ? { unplaced } : {}),
+    complete: a.complete && b.complete,
+  };
+}
 // One graph per repository, for the reason scanAll gives: names are only unique within one.
 function analyzeEach(root, opts) {
   if (!opts.repos || opts.repos.length < 2) return analyze(root, opts);
@@ -404,6 +419,7 @@ export function scan(root, opts = {}) {
       trace: f.path.map(p => ({ program: p.program, item: p.item, file: p.file, via: p.via, ...(p.dir ? { dir: p.dir } : {}), ...(p.elided ? { elided: p.elided } : {}) })),
       related: [{ path: f.source.file, line: f.source.line, detail: f.source.detail }],
       ...(f.also ? { also: f.also } : {}),
+      ...(f.routes ? { routes: f.routes } : {}),
     });
   }
   // One sink reached by many sources is one finding, not many: a report where a single statement
@@ -417,9 +433,11 @@ export function scan(root, opts = {}) {
     // A sink is credited only as far as the least-credited source that reaches it.
     const level = Math.min(held.level, f.level);
     const also = [...(held.also || []), ...(f.also || [])];
+    const routes = held.routes && f.routes ? mergeRoutes(held.routes, f.routes) : null;
     if (f.hops < held.hops) Object.assign(held, f, { sources: held.sources });
     held.level = level;
     if (also.length) held.also = also;
+    if (routes) held.routes = routes;
   }
   // A use one source's route reaches unchecked, and the report leaves out for another use of the same
   // index, still limits how far a finding at that use is credited.

package/lib/sets/hidden.mjs

@@ -127,7 +127,7 @@ const SEQUENCE_NUMBER = /^[A-Za-z]{0,4}\d{2,6}$/;
 const FIXED_INDICATOR = /^[ */\-Dd$]$/;
 const NOT_CODE = /^(\*>|\/\/|\/\*)/;
 // A directive that makes the rest of the file free format, where columns 1-6 are ordinary text.
-const TO_FREE = />>\s*SOURCE\s+(?:FORMAT\s+)?(?:IS\s+)?FREE\b|SOURCEFORMAT\s*\(?\s*["']?FREE/i;
+const TO_FREE = />>\s*SOURCE\s+(?:FORMAT\s+)?(?:IS\s+)?FREE\b|SOURCEFORMAT\s*(?:\(\s*)?["']?FREE/i;
 
 function sequencePayload(lines, format) {
   const rows = [];

package/lib/sets/hlasm.mjs

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Assembler stubs are where a COBOL estate does what COBOL cannot: switch to supervisor state, reach
+// another address space, run an instruction whose length or mask is decided at run time. This set
+// reads HLASM source as cards and reports those operations where they are written. It does not
+// assemble: macros are not expanded and conditional assembly is not evaluated (lib/hlasm.mjs).
+//
+// It also answers the question the COBOL side cannot: a CALL 'SUBRTN' with no COBOL program of that
+// name may be an assembler module, and a CSECT or ENTRY of that name here is where it is.
+import { inScope, isAssembler, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { readHlasm, OPERATIONS } from '../hlasm.mjs';
+
+export const HLASM_RULES = {
+  'hlasm-supervisor-state-change': {
+    sev: 'crit', evidence: 'construct', cwe: 'CWE-250',
+    text: 'Assembler source switches to PSW key zero or supervisor state',
+    impact: 'The code after the switch runs with the operating system\'s authority: it can read and change any storage, so a flaw in it is a flaw in the system rather than in one job',
+    remedy: 'Keep the authorized code to the instructions that need it, return to the caller\'s key and problem state straight after (MODESET KEY=NZERO, MODE=PROB), and APF-authorize the module only where it has to be',
+  },
+  'hlasm-executes-built-instruction': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-119',
+    text: 'Assembler source runs an instruction whose length or mask comes from a register at run time',
+    impact: 'EX and EXRL run their target instruction with its second byte taken from a register, which for a move is its length: a length from input moves past the end of the field it was meant for',
+    remedy: 'Bound the register against the target field\'s length before the EX, and keep the target instruction out of the code a caller can reach any other way',
+  },
+  'hlasm-cross-memory-service': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-668',
+    text: 'Assembler source uses a cross-memory instruction, reaching another address space or another authority',
+    impact: 'A program call, a program transfer or a change of secondary address space moves execution or data access across address spaces, under the authority the linkage tables grant rather than the caller\'s own',
+    remedy: 'Confirm the entry tables and authorization indexes grant only the address spaces and keys the service needs, and that every PC routine validates what its caller passes',
+  },
+  'hlasm-calls-security-product': { sev: 'info', evidence: 'context', cwe: null, text: 'Assembler source calls the security product directly' },
+  'hlasm-provides-called-module': { sev: 'info', evidence: 'context', cwe: null, text: 'An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs' },
+};
+
+const RULE_OF_CLASS = {
+  'cross-memory': 'hlasm-cross-memory-service',
+  'built-instruction': 'hlasm-executes-built-instruction',
+  'security-product': 'hlasm-calls-security-product',
+};
+
+const STATE = { KEY: 'PSW key zero', EXTKEY: 'PSW key zero', MODE: 'supervisor state' };
+
+const where = (use) => (use.inMacro ? ' It is in a macro definition, so it is in every program that uses the macro.' : '');
+
+function detail(use) {
+  const written = `${use.name}${use.field ? ` ${use.field}` : ''}`;
+  if (use.class === 'security-product') {
+    const request = /\bREQUEST=([A-Z]+)/i.exec(use.field || '');
+    return `${request ? `${use.name} REQUEST=${request[1].toUpperCase()}` : use.name} calls the security product from assembler rather than through a service that checks on the program's behalf.${where(use)}`;
+  }
+  return `${written}: ${OPERATIONS.get(use.name).summary}${where(use)}`;
+}
+
+// A COBOL CALL of a literal name, outside comment lines. A membership question over every program,
+// answered with a regular expression as lib/sets/jcl.mjs answers PROGRAM-ID.
+const CALL = /\bCALL\s+['"]([A-Z0-9$#@_-]{1,30})['"]/gi;
+
+function cobolCalls(source) {
+  const calls = [];
+  source.split(/\r?\n/).forEach((text, i) => {
+    if (text.length > 6 && '*/'.includes(text[6])) return;
+    for (const m of text.matchAll(CALL)) calls.push({ name: m[1].toUpperCase(), line: i + 1 });
+  });
+  return calls;
+}
+
+export function scanHlasm(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const all = tree.list().filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, assemblerFiles: 0, bmsFiles: 0, imsFiles: 0, unrecognisedFiles: 0, readNotAssembled: true };
+  const defines = new Map();
+
+  const run = eachWithinMemory(all.filter(isAssembler), (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const r = readHlasm(src);
+    if (r.kind === 'bms') { stats.bmsFiles++; return src.length; }
+    if (r.kind === 'ims') { stats.imsFiles++; return src.length; }
+    if (r.kind === 'unrecognised') { stats.unrecognisedFiles++; return src.length; }
+    stats.assemblerFiles++;
+    const path = relPath(root, f);
+    for (const d of r.defines) if (!defines.has(d.name)) defines.set(d.name, { ...d, path });
+    for (const use of r.operations) {
+      if (use.name === 'MODESET') {
+        if (use.stateChange) findings.push({ rule: 'hlasm-supervisor-state-change', path, line: use.line, detail: `MODESET ${use.stateChange} switches to ${STATE[use.stateChange.split('=')[0]]}.${where(use)}` });
+        continue;
+      }
+      const rule = RULE_OF_CLASS[use.class];
+      if (rule) findings.push({ rule, path, line: use.line, detail: detail(use) });
+    }
+    return src.length;
+  }, { label: 'hlasm', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  if (defines.size) {
+    const callers = new Map();
+    const programs = eachWithinMemory(all.filter(isProgram), (f) => {
+      let src;
+      try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+      for (const c of cobolCalls(src)) {
+        if (!defines.has(c.name)) continue;
+        if (!callers.has(c.name)) callers.set(c.name, []);
+        callers.get(c.name).push({ path: relPath(root, f), line: c.line });
+      }
+      return src.length;
+    }, { label: 'hlasm-callers', maxBytes: opts.maxSourceBytes ?? Infinity });
+    if (programs.skipped.length) stats.callersNotRead = programs.skipped.length;
+    for (const [name, calls] of callers) {
+      const d = defines.get(name);
+      const first = calls[0];
+      findings.push({ rule: 'hlasm-provides-called-module', path: d.path, line: d.line,
+        detail: `${d.how} ${name} is the module CALL '${name}' reaches from ${first.path}:${first.line}${calls.length > 1 ? ` and ${calls.length - 1} other CALL${calls.length > 2 ? 's' : ''}` : ''}` });
+    }
+  }
+
+  return report('hlasm', { rules: HLASM_RULES, findings, stats, run });
+}

package/lib/sets/jcl.mjs

@@ -3,10 +3,11 @@
 // authority, against which dataset; an in-stream SYSIN carries commands that never appear in any
 // program the scanner reads. The 2026-09-18 evaluation counted 27 JCL files carrying RACF or
 // IDCAMS commands in-stream, so this is where a repository's privileged surface actually lives.
-import { inScope, isJcl, isProgram, relPath } from '../sources.mjs';
+import { inScope, isAssembler, isJcl, isProgram, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
+import { readHlasm } from '../hlasm.mjs';
 import { ddGroups, tsoCommands } from '../utilities.mjs';
 import { ftpSession } from '../ftp.mjs';
 import { loadSite, productionQualifierOf, SITE_FILE } from '../site.mjs';
@@ -154,6 +155,7 @@ const DESTRUCTIVE = /^\s*(DELETE(?!\s+FROM\b)|ALTER\s+\S+\s+NEWNAME|REPRO\b[^\n]
 // symbol ends it. An empty qualifier is a symbol the reader already filled with an empty default.
 const dsnKey = (dsn) => String(dsn || '').replace(/^['(]+|[')]+$/g, '').replace(/\(.*$/, '').toUpperCase()
   .replace(/&[A-Z0-9@#$]+\.?/g, '*').replace(/<[^>]*>/g, '*').replace(/\.(?=\.)/g, '.*');
+// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- k is escaped, and * widened to one qualifier
 const dsnPattern = (k) => new RegExp(`^${k.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^.]+')}$`);
 
 // The programs whose in-stream data can delete a catalogued dataset. A step running another known
@@ -227,12 +229,25 @@ function programIds(tree, files, unread) {
   return ids;
 }
 
+// The modules assembler source in the tree defines: each CSECT and ENTRY name, which a step can run
+// as it runs a COBOL program.
+function assemblerModules(tree, files, unread) {
+  const names = [];
+  for (const f of files) {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { unread.push(`${tree.rel(f)}: ${e.code || e.name}`); continue; }
+    for (const d of readHlasm(src).defines) names.push(d.name);
+  }
+  return names;
+}
+
 export function scanJcl(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const jclFiles = all.filter(isJcl);
   const programsUnread = [];
   const defined = programIds(tree, all.filter(isProgram), programsUnread);
+  for (const name of assemblerModules(tree, all.filter(isAssembler), programsUnread)) defined.add(name);
 
   // A vendor product supplies its own utilities. An estate that has loaded the pack for a product
   // is telling us those programs exist, so reporting them as undefined would be a false positive

package/lib/sets/recon.mjs

@@ -107,6 +107,7 @@ function routableAddresses(text, jcl) {
 // A qualifier matches on a whole dotted component, never on a substring: PROD matches PROD.MASTER
 // and PRODLIB.X only if PRODLIB was itself listed. Matching on substrings is how a rule like this
 // starts reporting every line in the estate.
+// nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- q is escaped
 const qualifierPattern = (q) => new RegExp('(^|[^A-Z0-9$#@.])' + q.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '(?=[.\\s,)\'"]|$)', 'i');
 
 // JOBLIB and STEPLIB are where the system looks for the program, so what they hold is code rather