@portll/cobolwork 0.3.0 → 0.5.0

package/lib/sets/web.mjs

@@ -62,6 +62,18 @@ export const WEB_RULES = {
     impact: 'The TCPIPSERVICE takes connections on a port with SSL off, so everything the session carries - the 3270 data stream, a SOAP body, a credential on a sign-on screen - crosses the network in the clear and can be read or changed in flight',
     remedy: 'Set SSL(YES) and name a certificate on the TCPIPSERVICE, or front it with a TLS-terminating proxy the estate controls and restrict the port to that proxy',
   },
+  'web-client-opens-cleartext': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-319',
+    text: 'A program opens an outbound HTTP connection without TLS',
+    impact: 'WEB OPEN asks for HTTP rather than HTTPS, so the request the program sends and the response it reads cross the network in the clear, readable and changeable in flight, unless an AT-TLS policy outside the program encrypts them',
+    remedy: 'Open the connection with HTTPS, or through a client URIMAP with SCHEME(HTTPS); where AT-TLS secures it, use a URIMAP with ATTLS(AWARE) so the program fails rather than send in the clear',
+  },
+  'web-receive-length-exceeds-area': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-805',
+    text: 'A web receive lets CICS write more bytes than the area it writes into',
+    impact: 'CICS copies up to MAXLENGTH bytes of the body into the INTO area, so a body longer than the area, which the other end of the connection chooses, overwrites the storage after it',
+    remedy: 'Pass a MAXLENGTH no greater than the INTO area, or LENGTH OF that area',
+  },
   'web-link-opens-without-noopener': {
     sev: 'low', evidence: 'construct', cwe: 'CWE-1022',
     text: 'A program writes a link that opens a new window with a handle back to this one',
@@ -92,6 +104,18 @@ function execOptions(exec) {
   return { opts, words };
 }
 
+// The options written outside any parentheses, which is where a CVDA keyword such as HTTP or HTTPS
+// stands; a word inside an operand is a data name.
+function keywords(exec) {
+  const out = new Set();
+  let depth = 0;
+  for (const t of exec.toks) {
+    if (t.t === 'sep') depth += t.v === '(' ? 1 : t.v === ')' ? -1 : 0;
+    else if (t.t === 'word' && depth === 0) out.add(t.u);
+  }
+  return out;
+}
+
 // A header name or value is only knowable when the program wrote it as a literal. NAME(WS-HDR-NAME)
 // names a field whose contents this rule set cannot see, and a rule that guessed would be inventing
 // evidence, so the statement is counted as unreadable and reported as coverage, not as a pass.
@@ -152,6 +176,7 @@ export function scanWeb(root, opts = {}) {
   const stats = {
     filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0,
     webPrograms: 0, headersWritten: 0, headersComputed: 0, htmlResponses: 0, listenersDefined: 0,
+    outboundOpens: 0, opensUndecided: 0,
   };
   const where = (x, path) => ({ path: x.file ? relPath(root, x.file) : path, line: x.line || 1 });
 
@@ -161,12 +186,53 @@ export function scanWeb(root, opts = {}) {
     const cookies = [];
     let computedHeaders = 0;
 
+    const opens = [];              // every outbound WEB OPEN, and what it says about TLS
+    const receives = [];           // every receive into an area with a length it can be judged by
+    const item = (name) => p.items.find((i) => i.name === name);
+    // A variable naming a URIMAP or a host usually holds one literal from its VALUE clause.
+    const valueOf = (toks) => {
+      if (!toks || !toks.length) return null;
+      const lit = literalOf(toks);
+      if (lit !== null) return lit.trim();
+      const it = toks[0].t === 'word' ? item(toks[0].u) : null;
+      const v = it && it.values && it.values.find((x) => x.t === 'lit');
+      return v ? String(v.v).trim() : null;
+    };
+    // MAXLENGTH as a literal, or LENGTH OF an item. A data item's value can change before the
+    // command runs, so it is not judged.
+    const lengthOf = (toks) => {
+      if (!toks || !toks.length) return null;
+      if (toks.length === 1 && (toks[0].t === 'num' || /^\d+$/.test(String(toks[0].v)))) return { bytes: Number(toks[0].v), written: String(toks[0].v) };
+      if (toks.length >= 3 && toks[0].u === 'LENGTH' && toks[1].u === 'OF' && toks[2].t === 'word') {
+        const it = item(toks[2].u);
+        return it && it.size ? { bytes: it.size, written: `LENGTH OF ${toks[2].u}` } : null;
+      }
+      return null;
+    };
+
     for (const e of p.execs) {
       if (e.kind !== 'CICS') continue;
       const { opts: o, words: w } = execOptions(e);
       if (!w.includes('WEB') && !w.includes('DOCUMENT')) continue;
       const at = where(e, path);
 
+      if (w[0] === 'WEB' && w[1] === 'OPEN') {
+        const k = keywords(e);
+        // SCHEME(HTTPS) and SCHEME(DFHVALUE(HTTPS)) name the CVDA as the keyword does; any other
+        // operand is a field whose value is set at run time.
+        const named = (o.get('SCHEME') || []).map((t) => t.u);
+        const cvda = named.length && named.every((x) => ['DFHVALUE', 'HTTP', 'HTTPS'].includes(x)) ? named.find((x) => x !== 'DFHVALUE') : null;
+        opens.push({ at, https: k.has('HTTPS') || cvda === 'HTTPS', http: k.has('HTTP') || cvda === 'HTTP',
+          urimap: o.has('URIMAP') ? valueOf(o.get('URIMAP')) : undefined, host: o.has('HOST') ? valueOf(o.get('HOST')) : null });
+        continue;
+      }
+      if (w[0] === 'WEB' && (w[1] === 'RECEIVE' || w[1] === 'CONVERSE') && o.has('INTO')) {
+        const into = o.get('INTO')[0];
+        const area = into && into.t === 'word' ? item(into.u) : null;
+        const max = lengthOf(o.get('MAXLENGTH'));
+        if (area && area.size && max) receives.push({ at, verb: w[1], area: into.u, size: area.size, max });
+      }
+
       if (w.includes('WRITE') && w.includes('HTTPHEADER')) {
         const name = literalOf(o.get('HTTPHEADER') || o.get('NAME'));
         const value = literalOf(o.get('VALUE'));
@@ -228,19 +294,23 @@ export function scanWeb(root, opts = {}) {
     });
     const testsMethod = conditions.some((c) => c.some((t) => t.t === 'lit' && HTTP_METHOD.test(String(t.v).trim())));
 
-    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod };
+    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod, opens, receives };
   }
 
   // The listener that accepts the request these responses answer. It is defined in a CSD rather
   // than in a program, so this reads every file the way lib/sets/priv.mjs does: a DFHCSDUP listing
   // is named whatever the estate named it, and filtering on an extension is how a BMS count once
   // came out as zero.
+  // Client URIMAPs come from the same files: WEB OPEN URIMAP(name) takes its scheme from one.
+  const urimaps = new Map();
   for (const f of all) {
     let src;
     try { src = tree.text(f).text; } catch { continue; }
-    if (!/^\s*DEFINE\s+TCPIPSERVICE\s*\(/im.test(src)) continue;
+    if (!/^\s*DEFINE\s+(TCPIPSERVICE|URIMAP)\s*\(/im.test(src)) continue;
     const path = relPath(root, f);
-    for (const [name, svc] of parseCsd(src).tcpipservices) {
+    const csd = parseCsd(src);
+    for (const [name, u] of csd.urimaps) if (!urimaps.has(name)) urimaps.set(name, { ...u, path });
+    for (const [name, svc] of csd.tcpipservices) {
       stats.listenersDefined++;
       if (encrypted(svc)) continue;
       const carries = svc.protocol ? `${/^[AEIOU]/i.test(svc.protocol) ? 'an' : 'a'} ${svc.protocol} ` : '';
@@ -269,9 +339,34 @@ export function scanWeb(root, opts = {}) {
       // outbound session or answers a web request has said something worth judging even when it
       // writes no header and sends no page.
       const anything = v.headers.length || v.sends.length || v.cookies.length || v.looksHtml
-        || v.uris.length || v.built.length || (v.webRequest && v.changes.length);
+        || v.uris.length || v.built.length || (v.webRequest && v.changes.length) || v.opens.length || v.receives.length;
       if (!anything) continue;
       stats.webPrograms++;
+
+      for (const o of v.opens) {
+        stats.outboundOpens++;
+        const to = o.host ? ` to ${o.host}` : '';
+        if (o.https) continue;
+        if (o.http) {
+          findings.push({ rule: 'web-client-opens-cleartext', ...o.at, program: v.id,
+            detail: `${v.id} opens a connection${to} asking for HTTP rather than HTTPS, so what it sends and reads crosses the network in the clear unless an AT-TLS policy outside the program encrypts it` });
+          continue;
+        }
+        const u = o.urimap ? urimaps.get(o.urimap.toUpperCase()) : null;
+        if (u && /^HTTP$/i.test(u.scheme || '') && !/^AWARE$/i.test(u.attls || '')) {
+          findings.push({ rule: 'web-client-opens-cleartext', ...o.at, program: v.id,
+            detail: `${v.id} opens a connection through URIMAP ${o.urimap.toUpperCase()}, which ${u.path}:${u.line} defines with SCHEME(HTTP)${u.host ? ` to ${u.host}` : ''} and no ATTLS(AWARE), so what it sends and reads crosses the network in the clear unless an AT-TLS policy encrypts it` });
+          continue;
+        }
+        // A scheme in a variable, or a URIMAP the tree does not define, is decided where this cannot see.
+        if (!u || !u.scheme) stats.opensUndecided++;
+      }
+
+      for (const r of v.receives) {
+        if (r.max.bytes <= r.size) continue;
+        findings.push({ rule: 'web-receive-length-exceeds-area', ...r.at, program: v.id,
+          detail: `${v.id} has WEB ${r.verb} pass up to MAXLENGTH(${r.max.written}), ${r.max.bytes} bytes, into ${r.area}, which is ${r.size} bytes` });
+      }
       stats.headersWritten += v.headers.length;
       stats.headersComputed += v.computedHeaders;
 

package/lib/sources.mjs

@@ -14,6 +14,9 @@ export const PROGRAM_EXT = ['.cbl', '.cob', '.cobol', '.sqb', '.pco'];
 export const COPY_EXT = ['.cpy', '.copy', '.inc'];
 export const JCL_EXT = ['.jcl', '.job', '.proc', '.prc', '.cntl'];
 export const BMS_EXT = ['.bms'];
+// Assembler source. A BMS map or an IMS DBD or PSB is also assembler macros, and is often named .asm;
+// lib/hlasm.mjs tells them apart by the macros they hold.
+export const HLASM_EXT = ['.asm', '.mac', '.mlc', '.hlasm', '.assemble'];
 
 const has = (list) => (p) => list.includes(extname(p).toLowerCase());
 
@@ -46,6 +49,11 @@ function kindOfHead(head) {
   // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
   // classified before classifies differently.
   if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) return 'bms';
+  // Assembler source defines a section or a macro, and declares storage or a base register, in the
+  // operation field; either alone is a word a text file can hold. Tested after BMS, which is
+  // assembler macros too.
+  if (/^[^*\s]*[ \t]+(?:CSECT|RSECT|START|MACRO)(?=\s|$)/m.test(text)
+    && /^[^*\s]*[ \t]+(?:USING|DC|DS|BALR|BASR|STM|STMG|MEND)(?=\s|$)/m.test(text)) return 'hlasm';
   return null;
 }
 
@@ -116,10 +124,12 @@ export const isProgram = byExtOrContent(PROGRAM_EXT, 'program');
 export const isCopybook = byExtOrContent(COPY_EXT, 'copybook');
 export const isJcl = byExtOrContent(JCL_EXT, 'jcl');
 export const isBms = byExtOrContent(BMS_EXT, 'bms');
-// Not BMS, by either route: the sets that read every source file have not chosen to read maps.
+export const isAssembler = byExtOrContent(HLASM_EXT, 'hlasm');
+// Not BMS or assembler, by either route: the sets that read every source file have not chosen to
+// read maps or assembler.
 export const isSource = (p) => (extname(p)
   ? [...PROGRAM_EXT, ...COPY_EXT, ...JCL_EXT].includes(extname(p).toLowerCase())
-  : ![null, 'bms'].includes(sniffKind(p)));
+  : ![null, 'bms', 'hlasm'].includes(sniffKind(p)));
 
 // `opts.only` is about rule sets; this is about files. A rule set given an allow list reads the
 // files on it and no others.

package/lib/utilities.mjs

@@ -118,6 +118,7 @@ function commands(lines) {
 // The values of the first of `names` given as a keyword in a command, as in INFILE(IN) or
 // OUTDDNAME(TAPE1,TAPE2). A name only counts at the start of a word, so INDD is not LOGINDD.
 function param(text, names) {
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- names are literal keyword lists
   const m = new RegExp(`(?:^|[\\s,])(?:${names.join('|')})\\s*\\(([^)]*)\\)`, 'i').exec(text);
   return m ? m[1].split(/[\s,]+/).filter(Boolean).map((v) => upper(v.replace(/^'|'$/g, ''))) : null;
 }
@@ -341,6 +342,7 @@ function icetoolCopies(step, dds) {
   for (const st of statements) {
     if (!['COPY', 'SORT', 'MERGE'].includes(st.op)) continue;
     const named = (kw) => st.operands.flatMap((o) => {
+      // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- kw is a literal keyword
       const m = new RegExp(`^${kw}\\((.*)\\)$`, 'i').exec(o);
       return m ? m[1].split(',').map((n) => upper(n.trim())).filter(Boolean) : [];
     });

package/lib/verify.mjs

@@ -18,7 +18,8 @@ const END_TASK = 'end the task from CEDF or CEDX, or stop the program in the deb
 // What goes in, and what reading it at the operation shows. `run` says what letting the operation run
 // shows; null means it would act on something, so the plan stops before it (`stopBefore`).
 const SINKS = {
-  arithmetic: (x) => ({ value: `a letter where ${x.item} expects a digit, such as A in its first position`, reads: `${x.item} holding the letter`, run: 'the task abends ASRA, a data exception (S0C7 in batch), at the operation' }),
+  // A letter's low half is 1 to 9 and its zone a valid sign, so zoned arithmetic reads it as a digit.
+  arithmetic: (x) => ({ value: `an asterisk in every position of ${x.item}, whose digits it expects: a letter will not do, since zoned decimal reads a letter as a digit`, reads: `${x.item} holding the asterisks`, run: 'the task abends ASRA, a data exception (S0C7 in batch), at the operation' }),
   subscript: (x) => bounds(x, `${x.table ? `${x.table + 1}, one more than the ${x.table} entries in the table` : 'one more than the entries in the table'}, or 0`),
   'loop-bound': (x) => bounds(x, `${x.table ? `${x.table + 1}, one more than the ${x.table} entries in the table` : 'one more than the entries in the table'}`),
   'reference-modification': (x) => bounds(x, 'one more than the length of the field, or 0'),