@portll/cobolwork 0.3.0 → 0.5.0

package/rules/compliance-nist80053.json

@@ -1649,6 +1649,162 @@
     "quote": "Check the validity of the following information inputs"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-calls-security-product",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: Assembler source calls the security product directly. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-cross-memory-service",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: Assembler source uses a cross-memory instruction, reaching another address space or another authority. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-executes-built-instruction",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: Assembler source runs an instruction whose length or mask comes from a register at run time. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-provides-called-module",
+   "framework": "nist-800-53r5",
+   "clause": "CM-8",
+   "title": "System Component Inventory",
+   "rationale": "The rule reports: An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Develop and document an inventory of system components"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "hlasm-supervisor-state-change",
+   "framework": "nist-800-53r5",
+   "clause": "AC-6",
+   "title": "Least Privilege",
+   "rationale": "The rule reports: Assembler source switches to PSW key zero or supervisor state. That is authority granted or exercised beyond what the task requires, which this control exists to prevent.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-fixed-initialization-vector",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program enciphers through ICSF with an initialization vector that never changes. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-single-length-des-key",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program generates a single-length DES key through ICSF. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "icsf-weak-hash",
+   "framework": "nist-800-53r5",
+   "clause": "SC-13",
+   "title": "Cryptographic Protection",
+   "rationale": "The rule reports: A program hashes with MD5 or SHA-1 through ICSF. That is cryptography too weak for the use it is put to, which this control requires be chosen for each use and implemented.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Implement the following types of cryptography required for each specified cryptographic use"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts ends its run with an abend. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c4",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts ends its run with a protection exception (S0C4). That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-s0c7",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts ends its run with a data exception (S0C7). That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
+  {
+   "kind": "compliance",
+   "ruleId": "input-causes-abend-subscript-range",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: An input the program accepts drives a subscript or reference modification out of range, and the run abends. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "intermediate-result-loses-high-order-digits",
@@ -2117,6 +2273,19 @@
     "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "jcl-racf-new-password",
+   "framework": "nist-800-53r5",
+   "clause": "IA-5",
+   "title": "Authenticator Management",
+   "rationale": "The rule reports: Credential pattern: jcl racf new password. That is authenticator content established in a file rather than managed, which is what this control governs.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Establishing initial authenticator content for any authenticators issued by the organization"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "job-loads-from-an-authorised-library",
@@ -2442,6 +2611,19 @@
     "quote": "Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-client-opens-cleartext",
+   "framework": "nist-800-53r5",
+   "clause": "SC-8",
+   "title": "Transmission Confidentiality and Integrity",
+   "rationale": "The rule reports: A program opens an outbound HTTP connection without TLS. That is information crossing a network with nothing protecting it, which this control requires be protected in transit.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Protect the {{ insert: param, sc-08_odp }} of transmitted information."
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-cookie-without-secure-attributes",
@@ -2468,6 +2650,19 @@
     "quote": "Protect the authenticity of communications sessions."
    }
   },
+  {
+   "kind": "compliance",
+   "ruleId": "web-receive-length-exceeds-area",
+   "framework": "nist-800-53r5",
+   "clause": "SI-10",
+   "title": "Information Input Validation",
+   "rationale": "The rule reports: A web receive lets CICS write more bytes than the area it writes into. That is an information input reaching an operation without its validity having been checked, which is what this control requires.",
+   "source": {
+    "doc": "nist80053",
+    "retrieved": "2026-09-20",
+    "quote": "Check the validity of the following information inputs"
+   }
+  },
   {
    "kind": "compliance",
    "ruleId": "web-request-changes-state-without-a-token",

package/rules/gitleaks-mainframe.toml

@@ -9,19 +9,29 @@ useDefault = false
 [[rules]]
 id = "jcl-racf-password"
 description = "RACF password in a JCL statement (JOB card, EXEC PARM or DD)"
-regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\(?([A-Z0-9@#$]{1,8})(?:[,)\s]|$)'''
+regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\(?([A-Z0-9@#$]{1,8})(?:[,)'\s]|$)'''
 secretGroup = 1
 keywords = ["password="]
 [rules.allowlist]
-regexTarget = "secret"
-regexes = ['''(?i)^(x+|\*+|y+|n+|pass|passw(or)?d?|secret|dummy|changeme|password)$''']
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
+
+[[rules]]
+id = "jcl-racf-new-password"
+description = "New RACF password in a JCL PASSWORD=(old,new)"
+regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\([A-Z0-9@#$]{1,8},([A-Z0-9@#$]{1,8})\)'''
+secretGroup = 1
+keywords = ["password="]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
 
 [[rules]]
 id = "tso-logon-password"
 description = "TSO LOGON with an inline password"
-regex = '''(?im)^\s*(?://\*\s*)?LOGON\s+[A-Z@#$][A-Z0-9@#$]{0,7}/([A-Z0-9@#$]{1,8})\b'''
+regex = '''(?im)^\s*LOGON\s+[A-Z@#$][A-Z0-9@#$]{0,7}/([A-Z0-9@#$]{1,8})\b'''
 secretGroup = 1
 keywords = ["logon"]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
 
 [[rules]]
 id = "racf-command-password"
@@ -29,29 +39,33 @@ description = "RACF ADDUSER or ALTUSER with an inline PASSWORD(...)"
 regex = '''(?i)\b(?:ALTUSER|ALU|ADDUSER|AU)\s+\(?[A-Z0-9@#$]{1,8}\)?[^\n]*?\bPASSWORD\(\s*([A-Z0-9@#$]{1,8})\s*\)'''
 secretGroup = 1
 keywords = ["password("]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
 
 [[rules]]
 id = "cobol-value-credential"
 description = "COBOL data item named for a credential with a literal VALUE"
-regex = '''(?im)^[^*\n]{0,7}\s*\d{1,2}\s+[A-Z0-9-]*(?:PASSWORD|PASSWD|PASSWRD|PSWD|PWD|SECRET|APIKEY|API-KEY|ACCESS-KEY|TOKEN)[A-Z0-9-]*\b[^\n.]*?\bVALUES?\s+(?:IS\s+|ARE\s+)?(?:'([^'\n]{1,})'|"([^"\n]{1,})")'''
+regex = '''(?im)^[^*\n]{0,7}\s*\b(?:0?[1-9]|[1-4][0-9]|77)\s+[A-Z0-9-]*(?:PASSWORD|PASSWD|PASSWRD|PSWD|PWD|SECRET|APIKEY|API-KEY|ACCESS-KEY|(?:API|ACCESS|AUTH|BEARER|OAUTH|REFRESH)-?TOKEN)[A-Z0-9-]*\b[^.]*?\bVALUES?\s+(?:IS\s+|ARE\s+)?(?:'([^'\n]{1,})'|"([^"\n]{1,})")'''
 keywords = ["password", "passwd", "passwrd", "pswd", "pwd", "secret", "apikey", "api-key", "access-key", "token"]
-path = '''(?i)\.(cbl|cob|cobol|cpy|copy|sqb|pco|ccp)$'''
+path = '''(?i)\.(?:cbl|cob|cobol|cpy|copy|sqb|pco|ccp)$'''
 [rules.allowlist]
 regexTarget = "match"
-regexes = ['''(?i)VALUE\s+(?:IS\s+)?['"](x+|\*+|\s+|pass(word)?|secret|dummy|changeme|password:?|enter[^'"]*|invalid[^'"]*|wrong[^'"]*)['"]''']
+regexes = ['''(?i)VALUE\s+(?:IS\s+)?['"](?:x+|\*+|\s+|y|n|yes|no|true|false|on|off|[01]|pass(?:word)?|secret|dummy|changeme|password:?|enter[^'"]*|invalid[^'"]*|wrong[^'"]*|[^'"]*\S\s+\S[^'"]*)['"]''']
 
 [[rules]]
 id = "embedded-sql-connect-password"
 description = "EXEC SQL CONNECT with a literal password"
-regex = '''(?is)\bCONNECT\s+(?:TO\s+\S+\s+)?(?:USER\s+(?:'[^']*'|"[^"]*"|:?[A-Z0-9-]+)\s+USING|IDENTIFIED\s+BY)\s+(?:'([^'\n]{3,})'|"([^"\n]{3,})")'''
+regex = '''(?is)\bCONNECT\s+(?:TO\s+\S+\s+)?(?:USER\s+(?:'[^']*'|"[^"]*"|:?[A-Z0-9-]+)\s+USING|(?:(?:'[^']*'|"[^"]*"|:?[A-Z0-9-]+)\s+)?IDENTIFIED\s+BY)\s+(?:'([^'\n]{3,})'|"([^"\n]{3,})")'''
 keywords = ["connect"]
 [rules.allowlist]
 regexTarget = "match"
-regexes = ['''(?i)USING\s+['"](x+|\*+|pass(word)?|pwd|secret|dummy|changeme|your[-_ ]?password|<[^>]*>)['"]|IDENTIFIED\s+BY\s+['"](x+|\*+|pass(word)?|pwd|secret|dummy|changeme|your[-_ ]?password|<[^>]*>)['"]''']
+regexes = ['''(?i)(?:USING|IDENTIFIED\s+BY)\s+['"](?:x+|\*+|pass(?:word)?|pwd|secret|dummy|changeme|your[-_ ]?password|<[^>]*>)['"]''']
 
 [[rules]]
 id = "cics-signon-password"
 description = "EXEC CICS SIGNON, VERIFY PASSWORD or CHANGE PASSWORD with a literal password"
-regex = '''(?is)EXEC\s+CICS\s+(?:SIGNON|VERIFY|CHANGE\s+PASSWORD)\b.{0,300}?\bPASSWORD\(\s*'([^'\n]{1,8})'\s*\)'''
+regex = '''(?i)EXEC\s+CICS\s+(?:SIGNON|VERIFY|CHANGE)\b[^.]{0,300}?\bPASSWORD\(\s*'([^'\n]{1,8})'\s*\)'''
 secretGroup = 1
 keywords = ["password("]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']