@portll/cobolwork 0.4.0 → 0.5.0

package/README.md

@@ -63,6 +63,13 @@ request and writes SARIF for code scanning: [docs/github-action.md](docs/github-
 | JCL | credentials and security commands in in-stream data, destructive statements, `DLM=` tricks, FTP in cleartext or sending production data, production data touched by a test job |
 | The source | names nothing declares (code that cannot compile), shadowed copybooks, payloads hidden in columns 73-80 or aimed at AI readers |
 | The estate | production names outside production jobs, routable addresses, compiler and runtime versions with published advisories |
+| Assembler | a switch to key zero or supervisor state, an instruction run through `EX`, cross-memory calls, the security product called directly, and the CSECT or ENTRY a COBOL `CALL` or a job step reaches |
+| Cryptography | a single-length DES key, an MD5 or SHA-1 hash, or a fixed initialization vector asked of ICSF, read from IBM's parameter lists; an outbound CICS connection asking for HTTP |
+
+HLASM is read, not assembled: its statements are read from the cards and its operations looked up
+in a table that cites the IBM manual for each (`rules/hlasm-operations.json`). Macros are not
+expanded and conditional assembly is not evaluated, so an operation a site macro issues is seen
+where the macro is defined, and not where it is used.
 
 [docs/rule-sets.md](docs/rule-sets.md) describes each in full, with what it deliberately leaves out.
 Vendor packs for CA ACF2 and Top Secret, Control-M and Connect:Direct load only for estates that
@@ -107,6 +114,15 @@ that caller's storage. A value the subprogram keeps in its own storage can reach
 Findings carry no source text, so a report can be stored and passed on without carrying the code
 with it.
 
+`trace` is one route, the shortest, and sources that reach one sink are merged into one finding,
+counted in `sources`. With `--all-routes`, `scan` and `flow` give each path finding `routes`: every
+source, and every statement on any route from one of them to the sink, by verb, file and line.
+`complete` is false where the walk stopped at its budget or a step has no statement the engine can
+place. It leaves out no statement on a route the engine follows, and may name one no route takes:
+what a reader needs before saying a run covered every route (`docs/spec/reach.md` §9.8). Routes
+through what the engine does not read, such as an unparsed program or a caller written in another
+language, are not in it.
+
 `fingerprint` is what the finding is, rather than where it is printed today: the rule, the program
 and the paragraph or section it sits in (the job, step and DD for JCL), and the flagged statement's
 own text. No line number goes into it, so code added above a finding does not change it. `diff`

package/bin/cobolwork.mjs

@@ -80,6 +80,7 @@ Options
   --rules-path gitleaks print the path of the mainframe credential rules and exit
   --quiet               summary only
   --full-trace          list every hop of a data flow path, not its two ends
+  --all-routes          give each data flow finding every statement on any route from its sources (scan, flow)
   --base <ref>          diff: the git revision to compare against
   --head <ref>          diff: the revision under review (default: the working tree)
   --baseline <file>     judgements to apply; without it, ${BASELINE_FILE} in the scanned tree
@@ -145,6 +146,7 @@ function parseArgs(argv) {
     else if (a === '--rules-path') opts.rulesPath = argv[++i] || 'gitleaks';
     else if (a === '--quiet') opts.quiet = true;
     else if (a === '--full-trace') opts.fullTrace = true;
+    else if (a === '--all-routes') opts.allRoutes = true;
     else if (a === '--base') opts.base = value();
     else if (a === '--head') opts.head = value();
     else if (a === '--baseline') opts.baseline = value();
@@ -250,6 +252,10 @@ if (opts.fullTrace && opts._.length && !TRACE_COMMANDS.includes(opts._[0])) {
 `);
   process.exit(2);
 }
+if (opts.allRoutes && opts._.length && !['scan', 'flow'].includes(opts._[0])) {
+  process.stderr.write(`cobolwork: --all-routes is for scan and flow\n`);
+  process.exit(2);
+}
 const ADVISORY_COMMANDS = ['scan', 'baseline', 'tui', 'explain', 'build'];
 if (opts.advisoryFeeds && opts._.length && !ADVISORY_COMMANDS.includes(opts._[0])) {
   process.stderr.write(`cobolwork: ${opts._[0]} reads no advisories; ${ADVISORY_COMMANDS.join(', ')} do\n`);
@@ -340,7 +346,7 @@ try {
   } else if (command === 'evidence') {
     process.exitCode = evidenceCommand(target, opts, { toolVersion: VERSION, write: (s) => process.stdout.write(s) });
   } else if (command === 'scan' || command === 'flow') {
-    const flowOpts = { repos, fullTrace: opts.fullTrace === true, systemDirs };
+    const flowOpts = { repos, fullTrace: opts.fullTrace === true, allRoutes: opts.allRoutes === true, systemDirs };
     // The site file sits beside the members and is not one of them, so it is named rather than found.
     const site = resolve(root, SITE_FILE);
     const pds = opts.pdsExport ? pdsExportTree(root, { systemDirs }) : null;

package/lib/bms.mjs

@@ -55,6 +55,13 @@ const sublist = (v) => {
   return (inner ? splitOperands(inner[1]) : [v]).map((x) => x.trim()).filter(Boolean);
 };
 
+// L'NAME is NAME's length, and T', S', I', K', N', D' and O' its other attributes: the quote after the
+// letter opens no string when the letter starts a term and a symbol follows. CL8'TEXT' and D'1.5'
+// are constants, and their quotes do open one.
+// https://www.ibm.com/docs/en/hla-and-tf/1.6.0?topic=instructions-data-attributes
+const attributeReference = (text, i) => /[LTSIKNDO]/i.test(text[i - 1] || '')
+  && !/[A-Z0-9$#@_]/i.test(text[i - 2] || '') && /[A-Z$#@_&]/i.test(text[i + 1] || '');
+
 // Folds physical lines into statements. A map continues a statement in two ways, often both in one
 // file. An operand that fills the line to column 71 carries on in column 16 of the next line, which
 // is how a long INITIAL literal is split. A comma followed by a blank ends the line's operands and
@@ -78,6 +85,7 @@ export function foldStatements(src) {
     for (let i = from; i < text.length; i++) {
       const c = text[i];
       if (o.quoted) { o.st.field += c; if (c === "'") o.quoted = false; continue; }
+      if (c === "'" && attributeReference(text, i)) { o.st.field += c; continue; }
       if (c === "'") { o.quoted = true; o.st.field += c; continue; }
       if (c === ' ' || c === '\t') {
         o.reading = o.st.field.endsWith(',');

package/lib/capabilities.mjs

@@ -17,8 +17,8 @@ export const CAPABILITIES_SCHEMA_VERSION = 1;
 
 // Each command, what it takes and what it writes.
 export const COMMANDS = {
-  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
-  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
+  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--all-routes', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
+  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--all-routes', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
   inventory: { args: ['<path>'], options: ['--out', '--quiet', '--copylib', '--evidence'], documents: ['cobolwork-inventory'] },
   parse: { args: ['<file>'], options: ['--out'], documents: ['cobolwork-parse'] },
   sbom: { args: ['<path>'], options: ['--name', '--out', '--quiet', '--copylib', '--evidence'], documents: ['cyclonedx'] },

package/lib/consequence.mjs

@@ -124,6 +124,19 @@ const RULE_CLASSES = {
   'input-causes-abend': [],
   'input-causes-abend-s0c4': [MUTATES],
   'input-causes-abend-subscript-range': [MUTATES],
+  // Key zero or supervisor state is the operating system's authority, taken by the code itself.
+  'hlasm-supervisor-state-change': [ESCALATES],
+  // Nothing says input reaches EX's register, or which address space a cross-memory call reaches:
+  // the linkage tables grant that, and the source does not show them. Severity decides.
+  'hlasm-executes-built-instruction': [],
+  'hlasm-cross-memory-service': [],
+  // Disclosure in transit; severity decides.
+  'web-client-opens-cleartext': [],
+  'web-receive-length-exceeds-area': [MUTATES],
+  // Weak cryptography discloses or lets data be changed undetected; severity decides.
+  'icsf-single-length-des-key': [],
+  'icsf-weak-hash': [],
+  'icsf-fixed-initialization-vector': [],
 };
 
 // Coverage and context assert no defect, so they carry no consequence.

package/lib/constants.mjs

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// The literals that can be in a data item when a statement reads it, from the program's text: its
+// VALUE clause and its subordinates', each MOVE and STRING into it or into a group holding it, and a
+// hop or two back through an item those name. Anything else that can write it - a computation, a
+// READ or ACCEPT INTO, a CALL it is passed to by reference, a MOVE from a field with no constant -
+// leaves it open, which a caller reads as "and something this cannot see".
+const FIGURATIVE = /^(LOW-VALUES?|HIGH-VALUES?|SPACES?|ZEROS?|ZEROES|QUOTES?|NULLS?)$/;
+const WRITERS = new Set(['COMPUTE', 'ADD', 'SUBTRACT', 'MULTIPLY', 'DIVIDE', 'READ', 'ACCEPT', 'UNSTRING', 'INITIALIZE', 'SET', 'RETURN', 'INSPECT']);
+const NOT_OPERANDS = new Set(['TO', 'INTO', 'DELIMITED', 'BY', 'SIZE', 'OF', 'IN', 'ALL']);
+
+// The item, its subordinates and the groups that hold it.
+function family(p, name) {
+  const self = p.items.find((x) => x.name === name);
+  if (!self) return null;
+  const under = [];
+  const down = (it) => { for (const c of it.children || []) { if (c.level === 88) continue; under.push(c); down(c); } };
+  down(self);
+  const over = [];
+  for (let up = self.parent; up; up = up.parent) over.push(up);
+  return { self, under, over };
+}
+
+const nameOf = (t) => (typeof t === 'string' ? t : t && t.u);
+
+const valuesOf = (item) => (item.values || []).map((v) => (v.t === 'lit' ? String(v.v) : FIGURATIVE.test(v.u || '') ? v.u : null)).filter((v) => v !== null);
+
+// `ignoreCall(call)` names calls that read the item and do not write it, such as the one being judged.
+export function constantsReaching(p, name, { depth = 2, ignoreCall = () => false } = {}, seen = new Set()) {
+  const out = { values: [], open: false };
+  if (seen.has(name)) return out;
+  seen.add(name);
+  const f = family(p, name);
+  if (!f) return { values: [], open: true };
+  const names = new Set([name, ...f.under.map((x) => x.name), ...f.over.map((x) => x.name)]);
+  out.values.push(...valuesOf(f.self), ...f.under.flatMap(valuesOf));
+  for (const st of p.statements || []) {
+    if (!(st.targets || []).some((t) => names.has(nameOf(t)))) continue;
+    if (st.verb === 'MOVE' || st.verb === 'STRING') {
+      for (const t of st.sources || []) if (t && t.t === 'lit') out.values.push(String(t.v));
+      for (const l of st.literals || []) out.values.push(String(l && l.v !== undefined ? l.v : l));
+      for (const w of (st.sources || []).filter((t) => !(t && t.t === 'lit')).map(nameOf).filter((x) => x && !NOT_OPERANDS.has(x))) {
+        if (FIGURATIVE.test(w) || /^[+-]?\d/.test(w) || names.has(w)) { if (FIGURATIVE.test(w)) out.values.push(w); continue; }
+        if (depth === 0) { out.open = true; continue; }
+        const r = constantsReaching(p, w, { depth: depth - 1, ignoreCall }, seen);
+        out.values.push(...r.values);
+        if (r.open || !r.values.length) out.open = true;
+      }
+      continue;
+    }
+    if (WRITERS.has(st.verb)) out.open = true;
+  }
+  for (const c of p.calls || []) {
+    if (ignoreCall(c)) continue;
+    if ((c.using || []).some((u) => names.has(u.word) && u.mode !== 'CONTENT' && u.mode !== 'VALUE')) out.open = true;
+  }
+  return out;
+}
+
+// A rule array is eight-byte keywords side by side; one held in several fields reads the same.
+export const keywordsOf = (values) => new Set(values.flatMap((v) => (FIGURATIVE.test(v) ? [] : String(v).match(/.{1,8}/g) || []).map((k) => k.trim().toUpperCase()).filter(Boolean)));

package/lib/control.mjs

@@ -622,10 +622,14 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
 
   // ---- checks ----
   // The storage an item lies in: its record, or the record an 01 REDEFINES lays itself over.
+  const recordOf = new Map();
   const itemsInRecord = (item) => {
-    let top = item;
+    let top = recordOf.get(item);
+    if (top) return top;
+    top = item;
     while (top.parent) top = top.parent;
     for (let hops = 0; top.redefinesItem && hops < 64; hops++) top = top.redefinesItem;
+    if (item.parent) recordOf.set(item, top);
     return top;
   };
   const fieldKey = (f) => (f.index ? `IX:${f.index}` : f);
@@ -639,6 +643,33 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     const fEnd = f.offset + (f.contributes || f.size);
     return w.offset < fEnd && f.offset < wEnd;
   };
+  // Entries grouped by the storage their item lies in, so a lookup tries only what `overlaps` can
+  // accept: the same record, the same index, or a 66-level item, which overlaps any field.
+  const byStorage = (entries, itemOf) => {
+    const byRecord = new Map();
+    const byIndex = new Map();
+    const renames = [];
+    const plain = [];
+    const add = (map, k, e) => { const list = map.get(k); if (list) list.push(e); else map.set(k, [e]); };
+    for (const e of entries) {
+      const it = itemOf(e);
+      if (it.index) { add(byIndex, it.index, e); continue; }
+      plain.push(e);
+      if (it.level === 66) renames.push(e);
+      else add(byRecord, itemsInRecord(it), e);
+    }
+    return {
+      mayOverlap: (it) => {
+        if (it.index) return byIndex.get(it.index) || [];
+        if (it.level === 66) return plain;
+        const same = byRecord.get(itemsInRecord(it));
+        return same ? (renames.length ? same.concat(renames) : same) : renames;
+      },
+    };
+  };
+  // Arguments the CICS API documents as data-values, which the command reads and never fills: the
+  // program or transaction it transfers to or starts, and the system it ships the request to.
+  const CICS_READS = { LINK: ['PROGRAM', 'TRANSID', 'SYSID'], XCTL: ['PROGRAM'], START: ['TRANSID', 'SYSID'], RETURN: ['TRANSID'], LOAD: ['PROGRAM'], RELEASE: ['PROGRAM'] };
   const writtenBy = (n) => {
     const out = [];
     const add = (tok) => { const f = tok ? resolve(tok) : null; if (f) out.push(f.level === 88 && f.parent ? f.parent : f); };
@@ -667,28 +698,31 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
         }
       }
     } else if (n.e) {
-      // A command may fill what any option is given directly, except what it sends FROM. A name
-      // inside that argument's own parentheses - a subscript, a reference modification - is read.
+      // A command may fill what any option is given directly, except what it sends FROM and the
+      // data-values it reads. A name inside that argument's own parentheses - a subscript, a
+      // reference modification - is read.
+      const reads = (n.e.kind === 'CICS' && CICS_READS[n.e.toks[0]?.u]) || [];
       let depth = 0;
       let option = null;
       for (let i = 0; i < n.e.toks.length; i++) {
         const t = n.e.toks[i];
         if (t.t === 'sep') { depth += t.v === '(' ? 1 : -1; continue; }
         if (depth === 0) { option = t.t === 'word' ? t.u : option; continue; }
-        if (depth === 1 && t.t === 'word' && option !== 'FROM') add(t);
+        if (depth === 1 && t.t === 'word' && option !== 'FROM' && !reads.includes(option)) add(t);
       }
     }
     return out;
   };
   // A VALUE holds for the whole run only if no statement writes storage that overlaps the item.
-  let writtenItems = null;
+  let written = null;
   const neverWritten = (it) => {
     if (it.external) return false;
-    if (!writtenItems) {
-      writtenItems = [];
-      for (const n of nodes) if (n.kind === 'stmt' || n.kind === 'exec' || n.kind === 'step' || n.kind === 'call') writtenItems.push(...writtenBy(n));
+    if (!written) {
+      const all = [];
+      for (const n of nodes) if (n.kind === 'stmt' || n.kind === 'exec' || n.kind === 'step' || n.kind === 'call') all.push(...writtenBy(n));
+      written = byStorage(all, (w) => w);
     }
-    return !writtenItems.some((w) => overlaps(w, it));
+    return !written.mayOverlap(it).some((w) => overlaps(w, it));
   };
   const constValue = (toks) => {
     if (toks.length === 3 && WORD(toks[0], 'LENGTH') && WORD(toks[1], 'OF')) {
@@ -2373,17 +2407,17 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     for (const f of [c.x, c.t, c.f, c.rt, c.rf]) if (f != null) list.push(f);
     factsOfKey.set(c.key, list);
   }
+  const checkedFields = byStorage([...factsOfKey.keys()].filter((key) => fields.get(key)), (key) => fields.get(key));
   const killCache = new Map();
   const killOf = (w) => {
     if (!w) return null;
     let bits = killCache.get(w);
     if (bits !== undefined) return bits;
     bits = null;
-    for (const [key, list] of factsOfKey) {
-      const f = fields.get(key);
-      if (!f || !overlaps(w, f)) continue;
+    for (const key of checkedFields.mayOverlap(w)) {
+      if (!overlaps(w, fields.get(key))) continue;
       bits ||= new Uint32Array(words);
-      for (const x of list) bits[x >>> 5] |= 1 << (x & 31);
+      for (const x of factsOfKey.get(key)) bits[x >>> 5] |= 1 << (x & 31);
     }
     killCache.set(w, bits);
     return bits;
@@ -2629,10 +2663,15 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   // Every route from `entry` that reaches `stopAt` or the program's end, meeting at joins. A call
   // whose range never returns ends the route, as a STOP RUN does. `calls` collects the ranges the
   // routes perform, for whoever needs to know what depends on what.
+  // A run holds a bitset per node it reaches. Those of a run nobody reads any more are handed back
+  // and reused, since allocating them afresh for every run was most of the analysis's collection time.
+  const spare = [];
+  const copyOf = (bits) => { const a = spare.pop(); if (!a) return bits.slice(); a.set(bits); return a; };
+  const release = (IN) => { for (const a of IN.values()) spare.push(a); };
   function run(entry, input, stopAt, calls = null) {
     const IN = new Map();
     let exitOut = null;
-    IN.set(entry, input.slice());
+    IN.set(entry, copyOf(input));
     push(entry);
     while (heap.length) {
       const id = pop();
@@ -2643,7 +2682,7 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       if (id === stopAt) { if (exitOut) meetInto(exitOut, out); else exitOut = out.slice(); continue; }
       for (const s of n.succ) {
         const cur = IN.get(s);
-        if (!cur) { IN.set(s, out.slice()); push(s); } else if (meetInto(cur, out)) push(s);
+        if (!cur) { IN.set(s, copyOf(out)); push(s); } else if (meetInto(cur, out)) push(s);
       }
     }
     return { IN, exitOut };
@@ -2675,7 +2714,10 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       for (const d of n.derive || []) if (d.needs.every((x) => has(bits, x))) approved.add(d);
       for (const entry of n.implies || []) if (entry[2] && has(bits, entry[0])) approved.add(entry);
     }
-    const top = run(r.entry, ONES, r.end, calls).exitOut;
+    release(fromNone.IN);
+    const fromAll = run(r.entry, ONES, r.end, calls);
+    const top = fromAll.exitOut;
+    release(fromAll.IN);
     approved = null;
     for (const k of calls) { if (!callers.has(k)) callers.set(k, new Set()); callers.get(k).add(r); }
     const old = summaries.get(r.key);
@@ -2704,7 +2746,9 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     waiting.delete(c.key);
     const input = c.stopAt == null ? ZERO : rangeIn.get(c.key);
     const res = run(c.entry, input, c.stopAt);
+    const superseded = results.get(c.key);
     results.set(c.key, res.IN);
+    if (superseded) release(superseded);
     for (const [id, bits] of res.IN) {
       const n = nodes[id];
       if (n.kind !== 'call' || !byKey.has(n.range.key)) continue;
@@ -2723,7 +2767,7 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   for (const IN of results.values()) {
     for (const [id, bits] of IN) {
       const had = facts.get(id);
-      if (had) meetInto(had, bits); else facts.set(id, bits.slice());
+      if (had) meetInto(had, bits); else facts.set(id, bits);
     }
   }
   };

package/lib/csd.mjs

@@ -14,7 +14,7 @@ const COMMAND = /^\s*(DEFINE|ADD|ALTER|APPEND|COPY|DELETE|INITIALIZE|LIST|REMOVE
 // { tdqueues: Map(name -> { type, ddname, indirect, line }),
 //   transactions: Map(name -> { program, cmdsec, ressec, line }),
 //   tcpipservices: Map(name -> { port, protocol, ssl, authenticate, transaction, line }),
-//   urimaps: Map(name -> { usage, path, program, transaction, tcpipservice, line }) }
+//   urimaps: Map(name -> { usage, path, program, transaction, tcpipservice, scheme, host, attls, line }) }
 export function parseCsd(text) {
   const tdqueues = new Map();
   const transactions = new Map();
@@ -64,6 +64,11 @@ export function parseCsd(text) {
         program: attrs.get('PROGRAM') || null,
         transaction: attrs.get('TRANSACTION') || null,
         tcpipservice: attrs.get('TCPIPSERVICE') || null,
+        // A client URIMAP's scheme decides whether WEB OPEN URIMAP(name) asks for TLS; ATTLS(AWARE)
+        // has AT-TLS secure an HTTP scheme outside CICS.
+        scheme: attrs.get('SCHEME') || null,
+        host: attrs.get('HOST') || null,
+        attls: attrs.get('ATTLS') || null,
         line: b.line,
       });
     } else if (kind === 'TDQUEUE') {

package/lib/dataflow.mjs

@@ -189,6 +189,9 @@ export function analyze(root, opts = {}) {
   // Every hop of every trace, for the reader who is following one chain rather than counting
   // findings. Off by default: a chain-shaped program turns this quadratic in the chain length.
   const fullTrace = opts.fullTrace === true;
+  // Every statement on any route from a finding's source to its sink, not only the route the trace
+  // names: what a run must have executed before it can show a value does not arrive (reach.md §9.8).
+  const allRoutes = opts.allRoutes === true;
   let held = 0;
 
   // Which files, not just how many. A count names nothing to go and look at, and it cannot tell
@@ -216,7 +219,8 @@ export function analyze(root, opts = {}) {
   const rel = (p) => { let r = relOf.get(p); if (r === undefined) { r = relPath(root, p); relOf.set(p, r); } return r; };
   // `at` is the statement an edge that is not a statement's own is read at: the CALL or LINK that
   // passes an argument, the PUT or GET of a container.
-  // `link` marks an edge into a callee at a call site ({ call }) or back out to it ({ ret }).
+  // `link` marks an edge into a callee at a call site ({ call }) or back out to it ({ ret }), and
+  // `stmt` names the statement that carries an edge whose `why` is text.
   const edge = (a, b, why, dir, at, link) => {
     if (!a || !b || a === b) return;
     a.edgesOut.push({ to: b, why, dir, ...(at != null ? { at } : {}), ...link });
@@ -797,7 +801,7 @@ export function analyze(root, opts = {}) {
         if (verb === 'PUT' && o.has('CONTAINER')) {
           const name = optionName(o, 'CONTAINER');
           const from = nodeOfToken((o.get('FROM') || [])[0]);
-          if (name && from) edge(from, containerNode(name), `EXEC CICS PUT CONTAINER(${name})`, undefined, at.point);
+          if (name && from) edge(from, containerNode(name), `EXEC CICS PUT CONTAINER(${name})`, undefined, at.point, { stmt: { verb: 'EXEC CICS PUT', file: rel(at.file), line: at.line } });
           if (name) channelOf.set(name, optionName(o, 'CHANNEL'));
         }
         // A service call sends every container on its channel, and its URI decides where they go.
@@ -811,7 +815,7 @@ export function analyze(root, opts = {}) {
         if (verb === 'GET' && o.has('CONTAINER')) {
           const name = optionName(o, 'CONTAINER');
           const into = nodeOfToken((o.get('INTO') || o.get('SET') || [])[0]);
-          if (name && into) edge(containerNode(name), into, `EXEC CICS GET CONTAINER(${name})`, undefined, at.point);
+          if (name && into) edge(containerNode(name), into, `EXEC CICS GET CONTAINER(${name})`, undefined, at.point, { stmt: { verb: 'EXEC CICS GET', file: rel(at.file), line: at.line } });
         }
         // CONVERSE is always a client call; SEND is one only on a session this program opened. A
         // plain WEB SEND answers the request that started the program, which is its job.
@@ -901,9 +905,9 @@ export function analyze(root, opts = {}) {
           }
           const commarea = (o.get('COMMAREA') || o.get('FROM') || [])[0];
           const argNode = commarea ? nodeOfToken(commarea) : null;
-          if (pgm && pgm.t === 'lit' && argNode) transfers.push({ verb, callee: pgm.v.toUpperCase(), argNode, point: at.point });
+          if (pgm && pgm.t === 'lit' && argNode) transfers.push({ verb, callee: pgm.v.toUpperCase(), argNode, point: at.point, file: at.file, line: at.line });
           else if (pgm && pgm.t === 'word' && argNode && o.has('PROGRAM')) {
-            for (const callee of programsNamed(pgm, e)) { transfers.push({ verb, callee, argNode, point: at.point, through: pgm.u }); transfersTo.add(callee); }
+            for (const callee of programsNamed(pgm, e)) { transfers.push({ verb, callee, argNode, point: at.point, file: at.file, line: at.line, through: pgm.u }); transfersTo.add(callee); }
           }
           if (pgm && pgm.t === 'lit') (o.has('TRANSID') && !o.has('PROGRAM') ? startsTransactions : transfersTo).add(String(pgm.v).trim().toUpperCase());
         }
@@ -1046,22 +1050,24 @@ export function analyze(root, opts = {}) {
     for (const t of p.transfers) {
       const r = calleesOf(t.callee, p.file);
       const site = ++callSites;
+      const stmt = { verb: `EXEC CICS ${t.verb}`, file: rel(t.file), line: t.line };
       for (const callee of r.list) {
         if (!callee.commarea) continue;
-        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point, { call: site });
-        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`, undefined, undefined, { ret: site });
+        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point, { call: site, stmt });
+        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`, undefined, undefined, { ret: site, stmt });
       }
     }
     for (const c of p.callSites) {
       const r = calleesOf(c.name, p.file);
       const site = ++callSites;
+      const stmt = { verb: 'CALL', file: rel(c.file), line: c.line };
       for (const callee of r.list) {
         if (!callee.params) continue;
         c.args.forEach((arg, i) => {
           const param = callee.params[i];
           if (!param || !arg.node || !param.node) return;
-          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point, { call: site });
-          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`, undefined, undefined, { ret: site });
+          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point, { call: site, stmt });
+          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`, undefined, undefined, { ret: site, stmt });
         });
       }
       const callee = r.list.length === 1 ? r.list[0] : null;
@@ -1498,6 +1504,44 @@ export function analyze(root, opts = {}) {
     }
     return { partial, lo, hi, vague, ctx };
   }
+  // The statement that carries an edge: null for storage that overlays storage, which runs nothing,
+  // and undefined where the engine does not know which statement it is.
+  const OVERLAYS = new Set(['group', 'redefines', 'renames']);
+  const statementOf = (e) => {
+    if (e.stmt) return e.stmt;
+    if (e.why && typeof e.why === 'object') return { verb: e.why.verb, file: e.why.file, line: e.why.line };
+    return OVERLAYS.has(e.why) ? null : undefined;
+  };
+  // Every route from one walk's source to each sink it reached: the edges the walk could cross that
+  // lead on to the sink, taken or not, by node rather than by call context or bytes. That lists a
+  // statement no route needs sooner than it leaves out one a route does.
+  function attachRoutes(awaiting, crossed, src, cut) {
+    const into = new Map();
+    for (const c of crossed) {
+      const list = into.get(c.to);
+      if (list) list.push(c); else into.set(c.to, [c]);
+    }
+    for (const { finding, at } of awaiting) {
+      const onRoute = new Set([at]);
+      const stack = [at];
+      const statements = new Map();
+      let unplaced = 0;
+      while (stack.length) {
+        for (const c of into.get(stack.pop()) || []) {
+          const s = statementOf(c.e);
+          if (s) statements.set(`${s.file}:${s.line}:${s.verb}`, s);
+          else if (s === undefined) unplaced++;
+          if (!onRoute.has(c.from)) { onRoute.add(c.from); stack.push(c.from); }
+        }
+      }
+      finding.routes = {
+        sources: [{ kind: src.kind, file: rel(src.file), line: src.line }],
+        statements: [...statements.values()].sort((a, b) => byText(a.file, b.file) || a.line - b.line || byText(a.verb, b.verb)),
+        ...(unplaced ? { unplaced } : {}),
+        complete: !cut && !unplaced,
+      };
+    }
+  }
   for (const start of nodes) {
     if (!start.sources.length || !canReach[start.id]) continue;
     for (const src of start.sources) {
@@ -1515,6 +1559,8 @@ export function analyze(root, opts = {}) {
       // without a layout) partial taint does not descend at all.
       const queue = [{ node: start, partial: false, lo: 0, hi: 0, vague: false, prev: null, why: 'source' }];
       const partSeen = new Map();
+      const crossedEdges = allRoutes ? [] : null;
+      const awaiting = allRoutes ? [] : null;
       stampWhole[start.id] = walk;
       let cut = false;
       const began = edgesWalked;
@@ -1563,6 +1609,7 @@ export function analyze(root, opts = {}) {
             ...(best.level ? { guard: { program: by.program, item: by.name, file: rel(best.check.file), line: best.check.line, ...(best.level === 2 ? { stops: true } : {}) } } : {}),
             ...(!best.level && missed ? { checkElsewhere: { program: missed.node.program, item: missed.node.name, file: rel(missed.check.file), line: missed.check.line } } : {}),
           });
+          if (awaiting) awaiting.push({ finding: findings[findings.length - 1], at: cur.id });
           if (best.level && !own) credited.push({ finding: findings[findings.length - 1], node: cur, sink, level: best.level });
           if (sink.group) useGroup.set(findings[findings.length - 1], `${src.kind}|${src.file}:${src.line}|${sink.kind}|${sink.group}`);
         }
@@ -1572,6 +1619,7 @@ export function analyze(root, opts = {}) {
           const to = e.to;
           const crossed = cross(state, e);
           if (!crossed) continue;
+          if (crossedEdges) crossedEdges.push({ from: cur.id, to: to.id, e });
           const { partial, lo, hi, vague, ctx } = crossed;
           if (partial) {
             const pk = `${to.id}|${ctx}`;
@@ -1583,6 +1631,7 @@ export function analyze(root, opts = {}) {
         }
       }
       if (cut) stats.walksCut++;
+      if (awaiting?.length) attachRoutes(awaiting, crossedEdges, src, cut);
       // The walk keeps the shortest route to each sink, and credit on that route says nothing if
       // another reaches the sink without it. So the walk runs again, refusing to let the value leave
       // a node where the credit holds, and a sink it still reaches loses the credit: first for any

package/lib/hlasm.mjs

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// HLASM source, read and not assembled. The cards fold into statements as the assembler folds them
+// (lib/bms.mjs), and each statement's operation is looked up in rules/hlasm-operations.json, the
+// operations that matter to a reviewer, each with the IBM document that defines it. Macros are not
+// expanded and conditional assembly is not evaluated, so an operation is reported where it is
+// written: in a macro definition, or in a branch AIF jumps over, as much as anywhere else.
+import { readFileSync } from 'node:fs';
+import { foldStatements } from './bms.mjs';
+import { parseOperands, splitOperands } from './cards.mjs';
+
+const TABLE = JSON.parse(readFileSync(new URL('../rules/hlasm-operations.json', import.meta.url), 'utf8'));
+export const OPERATIONS = new Map(TABLE.operations.map((o) => [o.name, o]));
+
+// Operations only assembler source holds: sections, base registers, the instructions every
+// program's linkage uses, and macro definitions. x86 or 6502 source written in a .asm file has none.
+// The weak ones are words another assembler's source can hold (a 6502 `zproc start`), so it takes
+// two different ones to count. USING counts only with the comma between its base and register: a
+// comment line written `C  Using a ...`, as GMP's are, reads as label C and operation USING.
+const ASSEMBLER = new Set(['CSECT', 'DSECT', 'RSECT', 'USING', 'BALR', 'BASR', 'STM', 'STMG', 'LM', 'LMG', 'MVC',
+  'MACRO', 'MEND', 'AMODE', 'RMODE', 'LTORG', 'CNOP']);
+const WEAK = new Set(['START', 'DC', 'DS', 'BAL', 'BAS', 'DROP']);
+const strong = (s) => ASSEMBLER.has(s.operation) && (s.operation !== 'USING' || s.field.includes(','));
+
+// GNU assembler source, run through m4 as GMP's is, holds s390 instructions too, and is not HLASM.
+const GNU = /^dnl\b|^\s*\.(?:text|globl|global|section|align|file)\b|\b(?:PROLOGUE|EPILOGUE|ASM_START)\(/m;
+
+// The macros that make a file a BMS map or an IMS database or program definition, which their own
+// readers take.
+const BMS = new Set(['DFHMSD', 'DFHMDI', 'DFHMDF']);
+const IMS = new Set(['DBD', 'DBDGEN', 'SEGM', 'PSBGEN', 'PCB', 'SENSEG']);
+
+// MODESET changes the PSW key or the state; these operand values make it key zero or supervisor
+// state, and the opposite values (KEY=NZERO, MODE=PROB) return from it. EXTKEY is the inline form,
+// which sets only the PSW key.
+const STATE_CHANGE = { KEY: ['ZERO'], MODE: ['SUP'], EXTKEY: ['ZERO'] };
+
+const nameList = (field) => splitOperands(field || '').map((s) => s.trim().toUpperCase()).filter((s) => /^[A-Z$#@_][A-Z0-9$#@_]*$/.test(s));
+
+function stateChange(field) {
+  let ops;
+  try { ops = parseOperands(field || ''); } catch { return null; }
+  for (const [key, values] of Object.entries(STATE_CHANGE)) {
+    const v = ops.keywords.get(key);
+    if (v && values.includes(String(v).trim().toUpperCase())) return `${key}=${String(v).trim().toUpperCase()}`;
+  }
+  return null;
+}
+
+// What the file is, and in it: each operation the table names with where it is written; the
+// sections and entry points it defines, which a CALL or a job step can name; and the names it
+// leaves to the binder.
+export function readHlasm(text) {
+  const { statements, diags } = foldStatements(text);
+  const ops = statements.filter((s) => s.kind === 'statement');
+  const has = (set) => ops.some((s) => set.has(s.operation));
+  const weak = new Set(ops.filter((s) => WEAK.has(s.operation)).map((s) => s.operation)).size;
+  const assembler = !GNU.test(text) && (ops.some(strong) || weak >= 2);
+  const kind = has(BMS) ? 'bms' : has(IMS) ? 'ims' : assembler ? 'hlasm' : 'unrecognised';
+  const out = { kind, statements: ops.length, operations: [], defines: [], external: [], diags };
+  if (kind !== 'hlasm') return out;
+
+  let macroDepth = 0;
+  for (const s of ops) {
+    if (s.operation === 'MACRO') { macroDepth++; continue; }
+    if (s.operation === 'MEND') { macroDepth = Math.max(0, macroDepth - 1); continue; }
+    const inMacro = macroDepth > 0;
+    if (!inMacro && ['CSECT', 'RSECT', 'START'].includes(s.operation) && s.name && !s.name.startsWith('&')) {
+      out.defines.push({ name: s.name.toUpperCase(), how: s.operation, line: s.line });
+    }
+    if (!inMacro && s.operation === 'ENTRY') for (const name of nameList(s.field)) out.defines.push({ name, how: 'ENTRY', line: s.line });
+    if (!inMacro && (s.operation === 'EXTRN' || s.operation === 'WXTRN')) for (const name of nameList(s.field)) out.external.push({ name, how: s.operation, line: s.line });
+    const op = OPERATIONS.get(s.operation);
+    if (!op || op.class === 'section' || op.class === 'linkage') continue;
+    const use = { name: op.name, class: op.class, line: s.line, inMacro, field: s.field };
+    if (op.name === 'MODESET') use.stateChange = stateChange(s.field);
+    out.operations.push(use);
+  }
+  return out;
+}

package/lib/kernel/registry.mjs

@@ -28,6 +28,8 @@ import { scanCompile, COMPILE_RULES } from '../sets/compile.mjs';
 import { scanSemantics, SEMANTICS_RULES } from '../sets/semantics.mjs';
 import { scanZowe, ZOWE_RULES } from '../sets/zowe.mjs';
 import { scanAbend, ABEND_RULES } from '../sets/abend.mjs';
+import { scanHlasm, HLASM_RULES } from '../sets/hlasm.mjs';
+import { scanCrypto, CRYPTO_RULES } from '../sets/crypto.mjs';
 import { toolName } from './ruleset.mjs';
 
 // The order is the order a scan runs them and the order --only lists them. It is not significant
@@ -49,6 +51,8 @@ export const REGISTRY = [
   { name: 'semantics', scan: scanSemantics, rules: SEMANTICS_RULES },
   { name: 'zowe', scan: scanZowe, rules: ZOWE_RULES },
   { name: 'abend', scan: scanAbend, rules: ABEND_RULES },
+  { name: 'hlasm', scan: scanHlasm, rules: HLASM_RULES },
+  { name: 'crypto', scan: scanCrypto, rules: CRYPTO_RULES },
 ];
 
 // Re-exported from the kernel's ruleset module, which is where it has to live: this file imports

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"371041fbffe625df6b0a872249cf071268fcb6a6"}
+{"commit":"2144d560676dda84c8ae6546dfb7b858399f0b7d"}