@portll/cobolwork 0.4.0 → 0.5.0

package/lib/sets/abend.mjs

@@ -6,6 +6,7 @@
 // where the evidence verifies and the run's own journal records the abend the manifest claims, so
 // the finding rests on a record of the run rather than on the manifest's word.
 import { readFileSync, existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { delimiter, join, posix, basename } from 'node:path';
 import { report } from '../kernel/ruleset.mjs';
 import { verifyEvidence } from '../evidence/verify.mjs';
@@ -53,23 +54,55 @@ export function abendRule(abend) {
   return 'input-causes-abend';
 }
 
-// The abend a kept run's own journal records, or null.
+// The abend a kept run's own journal records, with the sources it read and the programs it CALLed,
+// or null.
 function journalAbend(evidenceDir, runId) {
   if (typeof runId !== 'string' || !/^[0-9TZ]+-[0-9a-f]{16}$/.test(runId)) return null;
   const file = join(evidenceDir, 'runs', `${runId}.jsonl`);
   if (!existsSync(file)) return null;
+  let abend = null;
+  const inputs = [];
+  const calls = [];
   for (const line of readFileSync(file, 'utf8').split('\n')) {
     if (!line) continue;
     const rec = JSON.parse(line);
-    if (rec.kind === 'abend') return rec;
+    if (rec.kind === 'abend') abend ??= rec;
+    else if (rec.kind === 'input') inputs.push(rec);
+    else if (rec.kind === 'call') calls.push(rec);
   }
-  return null;
+  return abend && { ...abend, inputs, calls };
 }
 
 const isString = (x) => typeof x === 'string' && x.length > 0;
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
-// One fuzz run: its findings, and what kept any of it from counting.
-export function loadAbendRun(dir) {
+// A manifest root as a directory of the scanned tree, or null when it is not one.
+function treeDir(dir) {
+  if (typeof dir !== 'string') return null;
+  const norm = posix.normalize(dir.replace(/\\/g, '/'));
+  return norm === '..' || norm.startsWith('../') || posix.isAbsolute(norm) ? null : norm;
+}
+
+// The directory in the scanned tree of the root the run read `file` from, located by the manifest's
+// roots: the root the journal's input record for that file names, or for a CALLed program's source,
+// which its call record names by path and digest alone, the root under which the tree holds that
+// file with that digest. Undefined where neither record names the file, null where the root cannot
+// be told or lies outside the tree.
+function rootDirectory(roots, journal, file, tree) {
+  if (!Array.isArray(roots)) return undefined;
+  const held = [...new Set(journal.inputs.filter((i) => i.path === file && Number.isInteger(i.root)).map((i) => i.root))];
+  if (held.length) return held.length === 1 ? treeDir(roots[held[0]]) : null;
+  const digests = new Set(journal.calls.filter((c) => c.from === file).map((c) => c.sha256));
+  if (!digests.size || !tree) return undefined;
+  const holding = [...new Set(roots.map(treeDir).filter((d) => d !== null && existsSync(join(tree, d, file))))];
+  const same = holding.filter((d) => digests.has(sha256(readFileSync(join(tree, d, file)))));
+  const found = same.length ? same : holding;
+  return found.length === 1 ? found[0] : null;
+}
+
+// One fuzz run: its findings, and what kept any of it from counting. `tree` is the scanned tree,
+// where a CALLed program's source is looked for.
+export function loadAbendRun(dir, tree) {
   const out = { dir: basename(dir), program: null, findings: [], problems: [], counts: null, notModelled: 0 };
   let doc;
   try { doc = JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')); } catch (e) {
@@ -111,7 +144,12 @@ export function loadAbendRun(dir) {
       out.problems.push(`run ${run.journal}: its journal records the abend at ${place.file}:${place.line}, not where the manifest puts it`);
       continue;
     }
-    const where = isString(place.file) ? posix.normalize(posix.join(posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
+    const rootDir = isString(place.file) ? rootDirectory(doc.roots, recorded, place.file, tree) : undefined;
+    if (rootDir === null) {
+      out.problems.push(`run ${run.journal}: the abend is in ${place.file}, which its journal and manifest do not place in the scanned tree`);
+      continue;
+    }
+    const where = isString(place.file) ? posix.normalize(posix.join(rootDir ?? posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
     const line = Number.isInteger(place.line) && place.line > 0 ? place.line : 1;
     const rule = abendRule(run.abend);
     const used = (Array.isArray(run.input) ? run.input : []).map((id) => inputs.get(id)).filter(Boolean)
@@ -134,7 +172,7 @@ export function loadAbendRun(dir) {
 
 export function scanAbend(root, opts = {}) {
   const dirs = abendRunPaths(opts);
-  const runs = dirs.map((d) => loadAbendRun(d));
+  const runs = dirs.map((d) => loadAbendRun(d, root));
   const findings = runs.flatMap((r) => r.findings.filter((f) => existsSync(join(root, f.path))));
   const stats = {
     filesScanned: 0, filesUnreadable: 0,

package/lib/sets/crypto.mjs

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// What a program asks ICSF for. A COBOL program reaches z/OS cryptography by CALLing an ICSF
+// callable service with positional arguments, and the strength it gets is in those arguments: the
+// key length it generates, the hash it names in a rule array, the initialization vector it passes.
+// rules/icsf-services.json holds each service's parameters in order, from IBM's manual, and which
+// keywords each rule reports and why.
+//
+// An argument is judged by the literals that can reach it (lib/constants.mjs). One a computation, a
+// read or another program fills is not judged, and is counted as undecided rather than passed.
+import { readFileSync } from 'node:fs';
+import { inScope, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { constantsReaching, keywordsOf } from '../constants.mjs';
+
+const TABLE = JSON.parse(readFileSync(new URL('../../rules/icsf-services.json', import.meta.url), 'utf8'));
+
+export const CRYPTO_RULES = {
+  'icsf-single-length-des-key': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-327',
+    text: 'A program generates a single-length DES key through ICSF',
+    impact: 'The key is 56 bits, which exhaustive search recovers, and every later encipher with it runs single DES, so the data it protects is readable by anyone who takes the ciphertext',
+    remedy: 'Generate an AES key (key_type_1 AESDATA with KEYLN16 or longer, or CSNBKGN2) and encipher with CSNBSAE or CSNBSYE and AES',
+  },
+  'icsf-weak-hash': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-328',
+    text: 'A program hashes with MD5 or SHA-1 through ICSF',
+    impact: 'Collisions are practical for both, so a digest no longer shows the text was not changed, and an MD5 or SHA-1 of a password is quick to reverse for a short one',
+    remedy: 'Name SHA-256 or longer in the rule array, or BCRYPT for a password',
+  },
+  'icsf-fixed-initialization-vector': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-1204',
+    text: 'A program enciphers through ICSF with an initialization vector that never changes',
+    impact: 'Equal messages encipher to equal ciphertext, and under CUSP or IPS a message shorter than a block is XORed with the same keystream every time, so whoever sees the ciphertexts learns which are equal and can recover short ones',
+    remedy: 'Pass a vector generated for each message (CSNBRNG, or CSNBRNGL) and send it with the ciphertext',
+  },
+};
+
+// Every name a service answers to, 31- and 64-bit, CSF and ALET forms, to its entry.
+const SERVICES = new Map();
+for (const s of TABLE.services) {
+  const a = s.entry_points || {};
+  const names = [s.name, ...(a['31-bit'] || []), ...(a['64-bit'] || []), ...((a.alet && a.alet['31-bit']) || []), ...((a.alet && a.alet['64-bit']) || [])];
+  for (const n of names) SERVICES.set(n.toUpperCase(), s);
+}
+const F = TABLE.findings;
+const ruleFor = { 'single-length-des-key': 'icsf-single-length-des-key', 'weak-hash': 'icsf-weak-hash' };
+const isIcsf = (c) => SERVICES.has(String(c.name || '').toUpperCase());
+
+const argument = (call, service, parameter) => {
+  const i = service.parameters.indexOf(parameter);
+  return i >= 0 && call.using[i] && call.using[i].word ? call.using[i].word : null;
+};
+const shown = (values) => [...new Set(values.map((v) => (/^[A-Z-]+$/.test(v) ? v : `'${v.trim()}'`)))].join(', ');
+
+export function scanCrypto(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(isProgram).filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0, icsfCalls: 0, argumentsUndecided: 0 };
+
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    if (!/CALL\s+['"]?CS[NF]/i.test(src)) return src.length;
+    let r;
+    try { r = tree.parse(f, src); } catch (e) { noteUnparsed(stats, tree, f, e); return src.length; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const p of r.programs) {
+      for (const c of p.calls || []) {
+        const service = SERVICES.get(String(c.name || '').toUpperCase());
+        if (!service || c.kind !== 'L') continue;
+        stats.icsfCalls++;
+        const at = { path: c.file ? relPath(root, c.file) : path, line: c.line || 1, program: p.id };
+        const read = (parameter) => {
+          const name = argument(c, service, parameter);
+          if (!name) return null;
+          const got = constantsReaching(p, name, { ignoreCall: isIcsf });
+          return { name, ...got, keywords: keywordsOf(got.values) };
+        };
+
+        for (const [key, rule] of Object.entries(ruleFor)) {
+          const fd = F[key];
+          if (!fd.services.includes(service.name)) continue;
+          const arg = read(fd.parameter);
+          if (!arg) continue;
+          const weak = fd.keywords.filter((k) => arg.keywords.has(k));
+          if (!weak.length) { if (arg.open || !arg.values.length) stats.argumentsUndecided++; continue; }
+          findings.push({ rule, ...at,
+            detail: `CALL '${c.name}' passes ${arg.name} as ${fd.parameter}, and ${arg.name} can hold ${weak.join(' or ')}` });
+        }
+
+        const iv = F['fixed-initialization-vector'];
+        if (!iv.services.includes(service.name)) continue;
+        const rules = read('rule_array');
+        if (rules && iv.withoutVector.some((k) => rules.keywords.has(k))) continue;
+        const vector = read(iv.parameter);
+        if (!vector) continue;
+        if (vector.open || !vector.values.length) { stats.argumentsUndecided++; continue; }
+        findings.push({ rule: 'icsf-fixed-initialization-vector', ...at,
+          detail: `CALL '${c.name}' passes ${vector.name} as its initialization vector, and nothing but ${shown(vector.values)} is ever put in it` });
+      }
+    }
+    return src.length;
+  }, { label: 'crypto', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  return report('crypto', { rules: CRYPTO_RULES, findings, stats, run });
+}

package/lib/sets/flow.mjs

@@ -349,6 +349,21 @@ const DEFAULT = { sev: 'med', evidence: 'path', cwe: null, text: 'Untrusted inpu
 // is safe for the sink - one of a list of literals, digits where digits are needed, a bound where an
 // index is - is not a finding at all, and is listed under `checked` with the check that stops it.
 const LOWER = { crit: 'high', high: 'med', med: 'low', low: 'info', info: 'info' };
+
+// The routes of two sources that reach one sink, as one finding carries them: every source, every
+// statement either route runs, and complete only where both are.
+const routeKey = (s) => `${s.file}:${s.line}:${s.verb ?? s.kind}`;
+function mergeRoutes(a, b) {
+  const union = (x, y) => [...new Map([...x, ...y].map((s) => [routeKey(s), s])).values()];
+  const order = (p, q) => (p.file < q.file ? -1 : p.file > q.file ? 1 : p.line - q.line);
+  const unplaced = (a.unplaced || 0) + (b.unplaced || 0);
+  return {
+    sources: union(a.sources, b.sources).sort(order),
+    statements: union(a.statements, b.statements).sort(order),
+    ...(unplaced ? { unplaced } : {}),
+    complete: a.complete && b.complete,
+  };
+}
 // One graph per repository, for the reason scanAll gives: names are only unique within one.
 function analyzeEach(root, opts) {
   if (!opts.repos || opts.repos.length < 2) return analyze(root, opts);
@@ -404,6 +419,7 @@ export function scan(root, opts = {}) {
       trace: f.path.map(p => ({ program: p.program, item: p.item, file: p.file, via: p.via, ...(p.dir ? { dir: p.dir } : {}), ...(p.elided ? { elided: p.elided } : {}) })),
       related: [{ path: f.source.file, line: f.source.line, detail: f.source.detail }],
       ...(f.also ? { also: f.also } : {}),
+      ...(f.routes ? { routes: f.routes } : {}),
     });
   }
   // One sink reached by many sources is one finding, not many: a report where a single statement
@@ -417,9 +433,11 @@ export function scan(root, opts = {}) {
     // A sink is credited only as far as the least-credited source that reaches it.
     const level = Math.min(held.level, f.level);
     const also = [...(held.also || []), ...(f.also || [])];
+    const routes = held.routes && f.routes ? mergeRoutes(held.routes, f.routes) : null;
     if (f.hops < held.hops) Object.assign(held, f, { sources: held.sources });
     held.level = level;
     if (also.length) held.also = also;
+    if (routes) held.routes = routes;
   }
   // A use one source's route reaches unchecked, and the report leaves out for another use of the same
   // index, still limits how far a finding at that use is credited.

package/lib/sets/hlasm.mjs

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Assembler stubs are where a COBOL estate does what COBOL cannot: switch to supervisor state, reach
+// another address space, run an instruction whose length or mask is decided at run time. This set
+// reads HLASM source as cards and reports those operations where they are written. It does not
+// assemble: macros are not expanded and conditional assembly is not evaluated (lib/hlasm.mjs).
+//
+// It also answers the question the COBOL side cannot: a CALL 'SUBRTN' with no COBOL program of that
+// name may be an assembler module, and a CSECT or ENTRY of that name here is where it is.
+import { inScope, isAssembler, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { readHlasm, OPERATIONS } from '../hlasm.mjs';
+
+export const HLASM_RULES = {
+  'hlasm-supervisor-state-change': {
+    sev: 'crit', evidence: 'construct', cwe: 'CWE-250',
+    text: 'Assembler source switches to PSW key zero or supervisor state',
+    impact: 'The code after the switch runs with the operating system\'s authority: it can read and change any storage, so a flaw in it is a flaw in the system rather than in one job',
+    remedy: 'Keep the authorized code to the instructions that need it, return to the caller\'s key and problem state straight after (MODESET KEY=NZERO, MODE=PROB), and APF-authorize the module only where it has to be',
+  },
+  'hlasm-executes-built-instruction': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-119',
+    text: 'Assembler source runs an instruction whose length or mask comes from a register at run time',
+    impact: 'EX and EXRL run their target instruction with its second byte taken from a register, which for a move is its length: a length from input moves past the end of the field it was meant for',
+    remedy: 'Bound the register against the target field\'s length before the EX, and keep the target instruction out of the code a caller can reach any other way',
+  },
+  'hlasm-cross-memory-service': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-668',
+    text: 'Assembler source uses a cross-memory instruction, reaching another address space or another authority',
+    impact: 'A program call, a program transfer or a change of secondary address space moves execution or data access across address spaces, under the authority the linkage tables grant rather than the caller\'s own',
+    remedy: 'Confirm the entry tables and authorization indexes grant only the address spaces and keys the service needs, and that every PC routine validates what its caller passes',
+  },
+  'hlasm-calls-security-product': { sev: 'info', evidence: 'context', cwe: null, text: 'Assembler source calls the security product directly' },
+  'hlasm-provides-called-module': { sev: 'info', evidence: 'context', cwe: null, text: 'An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs' },
+};
+
+const RULE_OF_CLASS = {
+  'cross-memory': 'hlasm-cross-memory-service',
+  'built-instruction': 'hlasm-executes-built-instruction',
+  'security-product': 'hlasm-calls-security-product',
+};
+
+const STATE = { KEY: 'PSW key zero', EXTKEY: 'PSW key zero', MODE: 'supervisor state' };
+
+const where = (use) => (use.inMacro ? ' It is in a macro definition, so it is in every program that uses the macro.' : '');
+
+function detail(use) {
+  const written = `${use.name}${use.field ? ` ${use.field}` : ''}`;
+  if (use.class === 'security-product') {
+    const request = /\bREQUEST=([A-Z]+)/i.exec(use.field || '');
+    return `${request ? `${use.name} REQUEST=${request[1].toUpperCase()}` : use.name} calls the security product from assembler rather than through a service that checks on the program's behalf.${where(use)}`;
+  }
+  return `${written}: ${OPERATIONS.get(use.name).summary}${where(use)}`;
+}
+
+// A COBOL CALL of a literal name, outside comment lines. A membership question over every program,
+// answered with a regular expression as lib/sets/jcl.mjs answers PROGRAM-ID.
+const CALL = /\bCALL\s+['"]([A-Z0-9$#@_-]{1,30})['"]/gi;
+
+function cobolCalls(source) {
+  const calls = [];
+  source.split(/\r?\n/).forEach((text, i) => {
+    if (text.length > 6 && '*/'.includes(text[6])) return;
+    for (const m of text.matchAll(CALL)) calls.push({ name: m[1].toUpperCase(), line: i + 1 });
+  });
+  return calls;
+}
+
+export function scanHlasm(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const all = tree.list().filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, assemblerFiles: 0, bmsFiles: 0, imsFiles: 0, unrecognisedFiles: 0, readNotAssembled: true };
+  const defines = new Map();
+
+  const run = eachWithinMemory(all.filter(isAssembler), (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const r = readHlasm(src);
+    if (r.kind === 'bms') { stats.bmsFiles++; return src.length; }
+    if (r.kind === 'ims') { stats.imsFiles++; return src.length; }
+    if (r.kind === 'unrecognised') { stats.unrecognisedFiles++; return src.length; }
+    stats.assemblerFiles++;
+    const path = relPath(root, f);
+    for (const d of r.defines) if (!defines.has(d.name)) defines.set(d.name, { ...d, path });
+    for (const use of r.operations) {
+      if (use.name === 'MODESET') {
+        if (use.stateChange) findings.push({ rule: 'hlasm-supervisor-state-change', path, line: use.line, detail: `MODESET ${use.stateChange} switches to ${STATE[use.stateChange.split('=')[0]]}.${where(use)}` });
+        continue;
+      }
+      const rule = RULE_OF_CLASS[use.class];
+      if (rule) findings.push({ rule, path, line: use.line, detail: detail(use) });
+    }
+    return src.length;
+  }, { label: 'hlasm', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  if (defines.size) {
+    const callers = new Map();
+    const programs = eachWithinMemory(all.filter(isProgram), (f) => {
+      let src;
+      try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+      for (const c of cobolCalls(src)) {
+        if (!defines.has(c.name)) continue;
+        if (!callers.has(c.name)) callers.set(c.name, []);
+        callers.get(c.name).push({ path: relPath(root, f), line: c.line });
+      }
+      return src.length;
+    }, { label: 'hlasm-callers', maxBytes: opts.maxSourceBytes ?? Infinity });
+    if (programs.skipped.length) stats.callersNotRead = programs.skipped.length;
+    for (const [name, calls] of callers) {
+      const d = defines.get(name);
+      const first = calls[0];
+      findings.push({ rule: 'hlasm-provides-called-module', path: d.path, line: d.line,
+        detail: `${d.how} ${name} is the module CALL '${name}' reaches from ${first.path}:${first.line}${calls.length > 1 ? ` and ${calls.length - 1} other CALL${calls.length > 2 ? 's' : ''}` : ''}` });
+    }
+  }
+
+  return report('hlasm', { rules: HLASM_RULES, findings, stats, run });
+}

package/lib/sets/jcl.mjs

@@ -3,10 +3,11 @@
 // authority, against which dataset; an in-stream SYSIN carries commands that never appear in any
 // program the scanner reads. The 2026-09-18 evaluation counted 27 JCL files carrying RACF or
 // IDCAMS commands in-stream, so this is where a repository's privileged surface actually lives.
-import { inScope, isJcl, isProgram, relPath } from '../sources.mjs';
+import { inScope, isAssembler, isJcl, isProgram, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
+import { readHlasm } from '../hlasm.mjs';
 import { ddGroups, tsoCommands } from '../utilities.mjs';
 import { ftpSession } from '../ftp.mjs';
 import { loadSite, productionQualifierOf, SITE_FILE } from '../site.mjs';
@@ -228,12 +229,25 @@ function programIds(tree, files, unread) {
   return ids;
 }
 
+// The modules assembler source in the tree defines: each CSECT and ENTRY name, which a step can run
+// as it runs a COBOL program.
+function assemblerModules(tree, files, unread) {
+  const names = [];
+  for (const f of files) {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { unread.push(`${tree.rel(f)}: ${e.code || e.name}`); continue; }
+    for (const d of readHlasm(src).defines) names.push(d.name);
+  }
+  return names;
+}
+
 export function scanJcl(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const jclFiles = all.filter(isJcl);
   const programsUnread = [];
   const defined = programIds(tree, all.filter(isProgram), programsUnread);
+  for (const name of assemblerModules(tree, all.filter(isAssembler), programsUnread)) defined.add(name);
 
   // A vendor product supplies its own utilities. An estate that has loaded the pack for a product
   // is telling us those programs exist, so reporting them as undefined would be a false positive

package/lib/sets/web.mjs

@@ -62,6 +62,18 @@ export const WEB_RULES = {
     impact: 'The TCPIPSERVICE takes connections on a port with SSL off, so everything the session carries - the 3270 data stream, a SOAP body, a credential on a sign-on screen - crosses the network in the clear and can be read or changed in flight',
     remedy: 'Set SSL(YES) and name a certificate on the TCPIPSERVICE, or front it with a TLS-terminating proxy the estate controls and restrict the port to that proxy',
   },
+  'web-client-opens-cleartext': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-319',
+    text: 'A program opens an outbound HTTP connection without TLS',
+    impact: 'WEB OPEN asks for HTTP rather than HTTPS, so the request the program sends and the response it reads cross the network in the clear, readable and changeable in flight, unless an AT-TLS policy outside the program encrypts them',
+    remedy: 'Open the connection with HTTPS, or through a client URIMAP with SCHEME(HTTPS); where AT-TLS secures it, use a URIMAP with ATTLS(AWARE) so the program fails rather than send in the clear',
+  },
+  'web-receive-length-exceeds-area': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-805',
+    text: 'A web receive lets CICS write more bytes than the area it writes into',
+    impact: 'CICS copies up to MAXLENGTH bytes of the body into the INTO area, so a body longer than the area, which the other end of the connection chooses, overwrites the storage after it',
+    remedy: 'Pass a MAXLENGTH no greater than the INTO area, or LENGTH OF that area',
+  },
   'web-link-opens-without-noopener': {
     sev: 'low', evidence: 'construct', cwe: 'CWE-1022',
     text: 'A program writes a link that opens a new window with a handle back to this one',
@@ -92,6 +104,18 @@ function execOptions(exec) {
   return { opts, words };
 }
 
+// The options written outside any parentheses, which is where a CVDA keyword such as HTTP or HTTPS
+// stands; a word inside an operand is a data name.
+function keywords(exec) {
+  const out = new Set();
+  let depth = 0;
+  for (const t of exec.toks) {
+    if (t.t === 'sep') depth += t.v === '(' ? 1 : t.v === ')' ? -1 : 0;
+    else if (t.t === 'word' && depth === 0) out.add(t.u);
+  }
+  return out;
+}
+
 // A header name or value is only knowable when the program wrote it as a literal. NAME(WS-HDR-NAME)
 // names a field whose contents this rule set cannot see, and a rule that guessed would be inventing
 // evidence, so the statement is counted as unreadable and reported as coverage, not as a pass.
@@ -152,6 +176,7 @@ export function scanWeb(root, opts = {}) {
   const stats = {
     filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0,
     webPrograms: 0, headersWritten: 0, headersComputed: 0, htmlResponses: 0, listenersDefined: 0,
+    outboundOpens: 0, opensUndecided: 0,
   };
   const where = (x, path) => ({ path: x.file ? relPath(root, x.file) : path, line: x.line || 1 });
 
@@ -161,12 +186,53 @@ export function scanWeb(root, opts = {}) {
     const cookies = [];
     let computedHeaders = 0;
 
+    const opens = [];              // every outbound WEB OPEN, and what it says about TLS
+    const receives = [];           // every receive into an area with a length it can be judged by
+    const item = (name) => p.items.find((i) => i.name === name);
+    // A variable naming a URIMAP or a host usually holds one literal from its VALUE clause.
+    const valueOf = (toks) => {
+      if (!toks || !toks.length) return null;
+      const lit = literalOf(toks);
+      if (lit !== null) return lit.trim();
+      const it = toks[0].t === 'word' ? item(toks[0].u) : null;
+      const v = it && it.values && it.values.find((x) => x.t === 'lit');
+      return v ? String(v.v).trim() : null;
+    };
+    // MAXLENGTH as a literal, or LENGTH OF an item. A data item's value can change before the
+    // command runs, so it is not judged.
+    const lengthOf = (toks) => {
+      if (!toks || !toks.length) return null;
+      if (toks.length === 1 && (toks[0].t === 'num' || /^\d+$/.test(String(toks[0].v)))) return { bytes: Number(toks[0].v), written: String(toks[0].v) };
+      if (toks.length >= 3 && toks[0].u === 'LENGTH' && toks[1].u === 'OF' && toks[2].t === 'word') {
+        const it = item(toks[2].u);
+        return it && it.size ? { bytes: it.size, written: `LENGTH OF ${toks[2].u}` } : null;
+      }
+      return null;
+    };
+
     for (const e of p.execs) {
       if (e.kind !== 'CICS') continue;
       const { opts: o, words: w } = execOptions(e);
       if (!w.includes('WEB') && !w.includes('DOCUMENT')) continue;
       const at = where(e, path);
 
+      if (w[0] === 'WEB' && w[1] === 'OPEN') {
+        const k = keywords(e);
+        // SCHEME(HTTPS) and SCHEME(DFHVALUE(HTTPS)) name the CVDA as the keyword does; any other
+        // operand is a field whose value is set at run time.
+        const named = (o.get('SCHEME') || []).map((t) => t.u);
+        const cvda = named.length && named.every((x) => ['DFHVALUE', 'HTTP', 'HTTPS'].includes(x)) ? named.find((x) => x !== 'DFHVALUE') : null;
+        opens.push({ at, https: k.has('HTTPS') || cvda === 'HTTPS', http: k.has('HTTP') || cvda === 'HTTP',
+          urimap: o.has('URIMAP') ? valueOf(o.get('URIMAP')) : undefined, host: o.has('HOST') ? valueOf(o.get('HOST')) : null });
+        continue;
+      }
+      if (w[0] === 'WEB' && (w[1] === 'RECEIVE' || w[1] === 'CONVERSE') && o.has('INTO')) {
+        const into = o.get('INTO')[0];
+        const area = into && into.t === 'word' ? item(into.u) : null;
+        const max = lengthOf(o.get('MAXLENGTH'));
+        if (area && area.size && max) receives.push({ at, verb: w[1], area: into.u, size: area.size, max });
+      }
+
       if (w.includes('WRITE') && w.includes('HTTPHEADER')) {
         const name = literalOf(o.get('HTTPHEADER') || o.get('NAME'));
         const value = literalOf(o.get('VALUE'));
@@ -228,19 +294,23 @@ export function scanWeb(root, opts = {}) {
     });
     const testsMethod = conditions.some((c) => c.some((t) => t.t === 'lit' && HTTP_METHOD.test(String(t.v).trim())));
 
-    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod };
+    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod, opens, receives };
   }
 
   // The listener that accepts the request these responses answer. It is defined in a CSD rather
   // than in a program, so this reads every file the way lib/sets/priv.mjs does: a DFHCSDUP listing
   // is named whatever the estate named it, and filtering on an extension is how a BMS count once
   // came out as zero.
+  // Client URIMAPs come from the same files: WEB OPEN URIMAP(name) takes its scheme from one.
+  const urimaps = new Map();
   for (const f of all) {
     let src;
     try { src = tree.text(f).text; } catch { continue; }
-    if (!/^\s*DEFINE\s+TCPIPSERVICE\s*\(/im.test(src)) continue;
+    if (!/^\s*DEFINE\s+(TCPIPSERVICE|URIMAP)\s*\(/im.test(src)) continue;
     const path = relPath(root, f);
-    for (const [name, svc] of parseCsd(src).tcpipservices) {
+    const csd = parseCsd(src);
+    for (const [name, u] of csd.urimaps) if (!urimaps.has(name)) urimaps.set(name, { ...u, path });
+    for (const [name, svc] of csd.tcpipservices) {
       stats.listenersDefined++;
       if (encrypted(svc)) continue;
       const carries = svc.protocol ? `${/^[AEIOU]/i.test(svc.protocol) ? 'an' : 'a'} ${svc.protocol} ` : '';
@@ -269,9 +339,34 @@ export function scanWeb(root, opts = {}) {
       // outbound session or answers a web request has said something worth judging even when it
       // writes no header and sends no page.
       const anything = v.headers.length || v.sends.length || v.cookies.length || v.looksHtml
-        || v.uris.length || v.built.length || (v.webRequest && v.changes.length);
+        || v.uris.length || v.built.length || (v.webRequest && v.changes.length) || v.opens.length || v.receives.length;
       if (!anything) continue;
       stats.webPrograms++;
+
+      for (const o of v.opens) {
+        stats.outboundOpens++;
+        const to = o.host ? ` to ${o.host}` : '';
+        if (o.https) continue;
+        if (o.http) {
+          findings.push({ rule: 'web-client-opens-cleartext', ...o.at, program: v.id,
+            detail: `${v.id} opens a connection${to} asking for HTTP rather than HTTPS, so what it sends and reads crosses the network in the clear unless an AT-TLS policy outside the program encrypts it` });
+          continue;
+        }
+        const u = o.urimap ? urimaps.get(o.urimap.toUpperCase()) : null;
+        if (u && /^HTTP$/i.test(u.scheme || '') && !/^AWARE$/i.test(u.attls || '')) {
+          findings.push({ rule: 'web-client-opens-cleartext', ...o.at, program: v.id,
+            detail: `${v.id} opens a connection through URIMAP ${o.urimap.toUpperCase()}, which ${u.path}:${u.line} defines with SCHEME(HTTP)${u.host ? ` to ${u.host}` : ''} and no ATTLS(AWARE), so what it sends and reads crosses the network in the clear unless an AT-TLS policy encrypts it` });
+          continue;
+        }
+        // A scheme in a variable, or a URIMAP the tree does not define, is decided where this cannot see.
+        if (!u || !u.scheme) stats.opensUndecided++;
+      }
+
+      for (const r of v.receives) {
+        if (r.max.bytes <= r.size) continue;
+        findings.push({ rule: 'web-receive-length-exceeds-area', ...r.at, program: v.id,
+          detail: `${v.id} has WEB ${r.verb} pass up to MAXLENGTH(${r.max.written}), ${r.max.bytes} bytes, into ${r.area}, which is ${r.size} bytes` });
+      }
       stats.headersWritten += v.headers.length;
       stats.headersComputed += v.computedHeaders;
 

package/lib/sources.mjs

@@ -14,6 +14,9 @@ export const PROGRAM_EXT = ['.cbl', '.cob', '.cobol', '.sqb', '.pco'];
 export const COPY_EXT = ['.cpy', '.copy', '.inc'];
 export const JCL_EXT = ['.jcl', '.job', '.proc', '.prc', '.cntl'];
 export const BMS_EXT = ['.bms'];
+// Assembler source. A BMS map or an IMS DBD or PSB is also assembler macros, and is often named .asm;
+// lib/hlasm.mjs tells them apart by the macros they hold.
+export const HLASM_EXT = ['.asm', '.mac', '.mlc', '.hlasm', '.assemble'];
 
 const has = (list) => (p) => list.includes(extname(p).toLowerCase());
 
@@ -46,6 +49,11 @@ function kindOfHead(head) {
   // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
   // classified before classifies differently.
   if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) return 'bms';
+  // Assembler source defines a section or a macro, and declares storage or a base register, in the
+  // operation field; either alone is a word a text file can hold. Tested after BMS, which is
+  // assembler macros too.
+  if (/^[^*\s]*[ \t]+(?:CSECT|RSECT|START|MACRO)(?=\s|$)/m.test(text)
+    && /^[^*\s]*[ \t]+(?:USING|DC|DS|BALR|BASR|STM|STMG|MEND)(?=\s|$)/m.test(text)) return 'hlasm';
   return null;
 }
 
@@ -116,10 +124,12 @@ export const isProgram = byExtOrContent(PROGRAM_EXT, 'program');
 export const isCopybook = byExtOrContent(COPY_EXT, 'copybook');
 export const isJcl = byExtOrContent(JCL_EXT, 'jcl');
 export const isBms = byExtOrContent(BMS_EXT, 'bms');
-// Not BMS, by either route: the sets that read every source file have not chosen to read maps.
+export const isAssembler = byExtOrContent(HLASM_EXT, 'hlasm');
+// Not BMS or assembler, by either route: the sets that read every source file have not chosen to
+// read maps or assembler.
 export const isSource = (p) => (extname(p)
   ? [...PROGRAM_EXT, ...COPY_EXT, ...JCL_EXT].includes(extname(p).toLowerCase())
-  : ![null, 'bms'].includes(sniffKind(p)));
+  : ![null, 'bms', 'hlasm'].includes(sniffKind(p)));
 
 // `opts.only` is about rule sets; this is about files. A rule set given an allow list reads the
 // files on it and no others.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portll/cobolwork",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "COBOL, JCL and CICS security analysis with zero runtime dependencies: reference-format parser, cross-program data flow, mainframe credential rules. Plugs into commitwork.",
   "license": "AGPL-3.0-or-later",
   "author": "Portll <john@portll.net>",