@portll/cobolwork 0.4.0 → 0.6.0

package/lib/sets/build.mjs

@@ -55,7 +55,7 @@ const COMPILERS = new Set(['gnucobol', 'opentext-cobol', 'ibm-enterprise-cobol']
 
 // Files that decide what the build runs. A repository states this in one of a small number of
 // conventional places, and reading only those keeps the rule from matching prose in a README.
-function isBuildFile(path) {
+export function isBuildFile(path) {
   const name = basename(path);
   const p = path.replace(/\\/g, '/').toLowerCase();
   if (/^(dockerfile|containerfile)(\..+)?$/i.test(name)) return true;
@@ -98,6 +98,21 @@ const PINS = [
   { product: 'cics-transaction-gateway', re: /from\s+\S*cics[-_]?transaction[-_]?gateway\S*:v?(\d+(?:\.\d+)+)/gi },
 ];
 
+// Every product version the text pins, once each, with the text that pins it.
+export function pinsIn(src) {
+  const out = [];
+  const seen = new Set();
+  for (const { product, re } of PINS) {
+    for (const m of src.matchAll(re)) {
+      const key = `${product}@${m[1]}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ product, version: m[1], text: m[0] });
+    }
+  }
+  return out;
+}
+
 function withMavenProperties(src) {
   const block = src.match(/<properties>([\s\S]*?)<\/properties>/i);
   if (!block) return src;
@@ -189,42 +204,33 @@ export function scanBuild(root, opts = {}) {
     if (/pom\.xml$/i.test(path)) src = withMavenProperties(src);
     const lines = src.split(/\r?\n/);
 
-    const seen = new Set();
-    for (const { product, re } of PINS) {
-      re.lastIndex = 0;
-      let m;
-      while ((m = re.exec(src)) !== null) {
-        const version = m[1];
-        const key = product + '@' + version;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        stats.pinsFound++;
-
-        const hits = advisoriesFor(product, version, extra);
-        if (!hits.length) continue;
-
-        // A pin written across lines, as Maven writes one, is reported at its version.
-        const needle = m[0].includes('\n') ? m[0].split('\n').pop().trim() : m[0];
-        const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
-        const exploited = hits.filter((a) => isKnownExploited(a.id));
-        const ids = hits.map((a) => a.id).sort(byText);
-
-        const kind = COMPILERS.has(product) ? 'compiler' : 'component';
-        if (exploited.length) {
-          findings.push({
-            rule: `build-pins-exploited-${kind}`, path, line,
-            detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
-            related: hits.map(relatedOf),
-            knownExploited: exploited.map((a) => a.id).sort(byText),
-          });
-        } else {
-          findings.push({
-            rule: `build-pins-vulnerable-${kind}`, path, line,
-            detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
-              (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
-            related: hits.map(relatedOf),
-          });
-        }
+    for (const { product, version, text } of pinsIn(src)) {
+      stats.pinsFound++;
+
+      const hits = advisoriesFor(product, version, extra);
+      if (!hits.length) continue;
+
+      // A pin written across lines, as Maven writes one, is reported at its version.
+      const needle = text.includes('\n') ? text.split('\n').pop().trim() : text;
+      const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
+      const exploited = hits.filter((a) => isKnownExploited(a.id));
+      const ids = hits.map((a) => a.id).sort(byText);
+
+      const kind = COMPILERS.has(product) ? 'compiler' : 'component';
+      if (exploited.length) {
+        findings.push({
+          rule: `build-pins-exploited-${kind}`, path, line,
+          detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
+          related: hits.map(relatedOf),
+          knownExploited: exploited.map((a) => a.id).sort(byText),
+        });
+      } else {
+        findings.push({
+          rule: `build-pins-vulnerable-${kind}`, path, line,
+          detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
+            (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
+          related: hits.map(relatedOf),
+        });
       }
     }
     return src.length;

package/lib/sets/cics.mjs

@@ -4,7 +4,7 @@ import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { dirname, join } from 'node:path';
 import { parseSource } from '../parser.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { buildControl, hasFact } from '../control.mjs';
 import { parseCsd } from '../csd.mjs';
 
@@ -201,7 +201,7 @@ function conditionsIgnored(p, path) {
 // away from, and this set kept doing it: on a 100,000-program repository it exhausted an 8 GB heap
 // and took a corpus run with it. What survives per program is an identifier, a communication area's
 // size, one boolean, and a short list of transfers.
-export function scanCics(root, opts = {}) {
+export function* scanCicsSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isProgram).filter(inScope(opts));
   // Identifier to the size of that program's DFHCOMMAREA, which is all a caller needs of a callee.
@@ -364,7 +364,7 @@ export function scanCics(root, opts = {}) {
   // Releasing each tree bounds what one program costs; it does not bound what a hundred thousand of
   // them cost together. The shared loop watches the heap and stops before V8 cannot collect, and
   // names every file it did not reach.
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     if (!/EXEC\s+CICS/i.test(src) && !/(?:^|[\s.])COPY\s+/i.test(src)) return src.length;
@@ -445,3 +445,5 @@ export function scanCics(root, opts = {}) {
 
   return report('cics', { rules: CICS_RULES, findings, stats, run });
 }
+
+export const scanCics = (root, opts = {}) => drive(scanCicsSteps(root, opts));

package/lib/sets/compile.mjs

@@ -13,7 +13,7 @@ import { basename, extname } from 'node:path';
 import { inScope, isProgram, relPath, readSource } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 
 // construct: no input has to reach it. med: certain once every copybook is found, and it means the
 // tree does not hold what runs, but it is not exploitable in itself. CWE-1127: MITRE discourages
@@ -102,7 +102,7 @@ function truncated(ref, lines) {
   return any && !whole;
 }
 
-export function scanCompile(root, opts = {}) {
+export function* scanCompileSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isProgram).filter(inScope(opts));
   const findings = [];
@@ -117,7 +117,7 @@ export function scanCompile(root, opts = {}) {
   const textOf = (p) => (tree.contains(p) ? tree.text(p) : readSource(p)).text;
   const candidates = [];
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     if (LISTING.test(src)) { stats.filesScanned++; stats.listingsSkipped = (stats.listingsSkipped || 0) + 1; return src.length; }
@@ -186,3 +186,5 @@ export function scanCompile(root, opts = {}) {
   if (stats.filesUnparsed) stats.coverageIncomplete = true;
   return report('compile', { rules: COMPILE_RULES, findings, stats, run });
 }
+
+export const scanCompile = (root, opts = {}) => drive(scanCompileSteps(root, opts));

package/lib/sets/copybook.mjs

@@ -6,7 +6,7 @@ import { inScope, isCopybook, isProgram, relPath } from '../sources.mjs';
 import { finish } from '../kernel/findings.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { cobolCard } from '../cards.mjs';
 
 // A copybook is resolved by name along a search path: the program's own directory first, then the
@@ -71,7 +71,7 @@ export function systemLayoutDeparture(name, text) {
   return null;
 }
 
-export function scanCopybooks(root, opts = {}) {
+export function* scanCopybooksSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const findings = [];
@@ -100,7 +100,7 @@ export function scanCopybooks(root, opts = {}) {
   // is what stops the reading before the heap does.
   let run = { skipped: [], stoppedBy: null, peakHeapBytes: 0, note: null };
   if (candidates.size) {
-    run = eachWithinMemory(all.filter(isProgram), (p) => {
+    run = yield loopOver(all.filter(isProgram), (p) => {
       let src;
       try { src = tree.text(p).text; } catch (e) { noteUnread(stats, tree, p, e); return 0; }
       let r;
@@ -173,3 +173,5 @@ export function scanCopybooks(root, opts = {}) {
   // that looks unshadowed may only look that way.
   return report('copybook', { rules: COPYBOOK_RULES, findings, stats, run });
 }
+
+export const scanCopybooks = (root, opts = {}) => drive(scanCopybooksSteps(root, opts));

package/lib/sets/crypto.mjs

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// What a program asks ICSF for. A COBOL program reaches z/OS cryptography by CALLing an ICSF
+// callable service with positional arguments, and the strength it gets is in those arguments: the
+// key length it generates, the hash it names in a rule array, the initialization vector it passes.
+// rules/icsf-services.json holds each service's parameters in order, from IBM's manual, and which
+// keywords each rule reports and why.
+//
+// An argument is judged by the literals that can reach it (lib/constants.mjs). One a computation, a
+// read or another program fills is not judged, and is counted as undecided rather than passed.
+import { readFileSync } from 'node:fs';
+import { inScope, isProgram, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { constantsReaching, keywordsOf } from '../constants.mjs';
+
+const TABLE = JSON.parse(readFileSync(new URL('../../rules/icsf-services.json', import.meta.url), 'utf8'));
+
+export const CRYPTO_RULES = {
+  'icsf-single-length-des-key': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-327',
+    text: 'A program generates a single-length DES key through ICSF',
+    impact: 'The key is 56 bits, which exhaustive search recovers, and every later encipher with it runs single DES, so the data it protects is readable by anyone who takes the ciphertext',
+    remedy: 'Generate an AES key (key_type_1 AESDATA with KEYLN16 or longer, or CSNBKGN2) and encipher with CSNBSAE or CSNBSYE and AES',
+  },
+  'icsf-weak-hash': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-328',
+    text: 'A program hashes with MD5 or SHA-1 through ICSF',
+    impact: 'Collisions are practical for both, so a digest no longer shows the text was not changed, and an MD5 or SHA-1 of a password is quick to reverse for a short one',
+    remedy: 'Name SHA-256 or longer in the rule array, or BCRYPT for a password',
+  },
+  'icsf-fixed-initialization-vector': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-1204',
+    text: 'A program enciphers through ICSF with an initialization vector that never changes',
+    impact: 'Equal messages encipher to equal ciphertext, and under CUSP or IPS a message shorter than a block is XORed with the same keystream every time, so whoever sees the ciphertexts learns which are equal and can recover short ones',
+    remedy: 'Pass a vector generated for each message (CSNBRNG, or CSNBRNGL) and send it with the ciphertext',
+  },
+};
+
+// Every name a service answers to, 31- and 64-bit, CSF and ALET forms, to its entry.
+const SERVICES = new Map();
+for (const s of TABLE.services) {
+  const a = s.entry_points || {};
+  const names = [s.name, ...(a['31-bit'] || []), ...(a['64-bit'] || []), ...((a.alet && a.alet['31-bit']) || []), ...((a.alet && a.alet['64-bit']) || [])];
+  for (const n of names) SERVICES.set(n.toUpperCase(), s);
+}
+const F = TABLE.findings;
+const ruleFor = { 'single-length-des-key': 'icsf-single-length-des-key', 'weak-hash': 'icsf-weak-hash' };
+const isIcsf = (c) => SERVICES.has(String(c.name || '').toUpperCase());
+
+const argument = (call, service, parameter) => {
+  const i = service.parameters.indexOf(parameter);
+  return i >= 0 && call.using[i] && call.using[i].word ? call.using[i].word : null;
+};
+const shown = (values) => [...new Set(values.map((v) => (/^[A-Z-]+$/.test(v) ? v : `'${v.trim()}'`)))].join(', ');
+
+export function scanCrypto(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(isProgram).filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0, icsfCalls: 0, argumentsUndecided: 0 };
+
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    if (!/CALL\s+['"]?CS[NF]/i.test(src)) return src.length;
+    let r;
+    try { r = tree.parse(f, src); } catch (e) { noteUnparsed(stats, tree, f, e); return src.length; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const p of r.programs) {
+      for (const c of p.calls || []) {
+        const service = SERVICES.get(String(c.name || '').toUpperCase());
+        if (!service || c.kind !== 'L') continue;
+        stats.icsfCalls++;
+        const at = { path: c.file ? relPath(root, c.file) : path, line: c.line || 1, program: p.id };
+        const read = (parameter) => {
+          const name = argument(c, service, parameter);
+          if (!name) return null;
+          const got = constantsReaching(p, name, { ignoreCall: isIcsf });
+          return { name, ...got, keywords: keywordsOf(got.values) };
+        };
+
+        for (const [key, rule] of Object.entries(ruleFor)) {
+          const fd = F[key];
+          if (!fd.services.includes(service.name)) continue;
+          const arg = read(fd.parameter);
+          if (!arg) continue;
+          const weak = fd.keywords.filter((k) => arg.keywords.has(k));
+          if (!weak.length) { if (arg.open || !arg.values.length) stats.argumentsUndecided++; continue; }
+          findings.push({ rule, ...at,
+            detail: `CALL '${c.name}' passes ${arg.name} as ${fd.parameter}, and ${arg.name} can hold ${weak.join(' or ')}` });
+        }
+
+        const iv = F['fixed-initialization-vector'];
+        if (!iv.services.includes(service.name)) continue;
+        const rules = read('rule_array');
+        if (rules && iv.withoutVector.some((k) => rules.keywords.has(k))) continue;
+        const vector = read(iv.parameter);
+        if (!vector) continue;
+        if (vector.open || !vector.values.length) { stats.argumentsUndecided++; continue; }
+        findings.push({ rule: 'icsf-fixed-initialization-vector', ...at,
+          detail: `CALL '${c.name}' passes ${vector.name} as its initialization vector, and nothing but ${shown(vector.values)} is ever put in it` });
+      }
+    }
+    return src.length;
+  }, { label: 'crypto', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  return report('crypto', { rules: CRYPTO_RULES, findings, stats, run });
+}

package/lib/sets/flow.mjs

@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { analyze } from '../dataflow.mjs';
+import { resolve } from 'node:path';
+import { directoryTree } from '../kernel/source-tree.mjs';
+import { analyzeSteps } from '../dataflow.mjs';
+import { drive } from '../kernel/shared-pass.mjs';
 import { FLOW_MODEL, SCHEMA_VERSION, TOOL_VERSION } from '../version.mjs';
 import { finish, withMeta, sortFindings } from '../kernel/findings.mjs';
 
@@ -349,12 +352,27 @@ const DEFAULT = { sev: 'med', evidence: 'path', cwe: null, text: 'Untrusted inpu
 // is safe for the sink - one of a list of literals, digits where digits are needed, a bound where an
 // index is - is not a finding at all, and is listed under `checked` with the check that stops it.
 const LOWER = { crit: 'high', high: 'med', med: 'low', low: 'info', info: 'info' };
+
+// The routes of two sources that reach one sink, as one finding carries them: every source, every
+// statement either route runs, and complete only where both are.
+const routeKey = (s) => `${s.file}:${s.line}:${s.verb ?? s.kind}`;
+function mergeRoutes(a, b) {
+  const union = (x, y) => [...new Map([...x, ...y].map((s) => [routeKey(s), s])).values()];
+  const order = (p, q) => (p.file < q.file ? -1 : p.file > q.file ? 1 : p.line - q.line);
+  const unplaced = (a.unplaced || 0) + (b.unplaced || 0);
+  return {
+    sources: union(a.sources, b.sources).sort(order),
+    statements: union(a.statements, b.statements).sort(order),
+    ...(unplaced ? { unplaced } : {}),
+    complete: a.complete && b.complete,
+  };
+}
 // One graph per repository, for the reason scanAll gives: names are only unique within one.
-function analyzeEach(root, opts) {
-  if (!opts.repos || opts.repos.length < 2) return analyze(root, opts);
+function* analyzeEach(root, opts) {
+  if (!opts.repos || opts.repos.length < 2) return yield* analyzeSteps(root, opts);
   const merged = { findings: [], constructs: [], unstarted: [], startedBy: {}, stats: {} };
   for (const repo of opts.repos) {
-    const one = analyze(root, { ...opts, repos: [repo] });
+    const one = yield* analyzeSteps(root, { ...opts, repos: [repo] });
     merged.findings.push(...one.findings);
     merged.constructs.push(...one.constructs);
     merged.unstarted.push(...one.unstarted);
@@ -371,8 +389,9 @@ function analyzeEach(root, opts) {
   return merged;
 }
 
-export function scan(root, opts = {}) {
-  const res = analyzeEach(root, opts);
+export function* scanSteps(root, opts = {}) {
+  root = resolve(root);
+  const res = yield* analyzeEach(root, opts);
   const findings = [];
   for (const f of res.findings) {
     const meta = RULES[f.rule] || DEFAULT;
@@ -404,6 +423,7 @@ export function scan(root, opts = {}) {
       trace: f.path.map(p => ({ program: p.program, item: p.item, file: p.file, via: p.via, ...(p.dir ? { dir: p.dir } : {}), ...(p.elided ? { elided: p.elided } : {}) })),
       related: [{ path: f.source.file, line: f.source.line, detail: f.source.detail }],
       ...(f.also ? { also: f.also } : {}),
+      ...(f.routes ? { routes: f.routes } : {}),
     });
   }
   // One sink reached by many sources is one finding, not many: a report where a single statement
@@ -417,9 +437,11 @@ export function scan(root, opts = {}) {
     // A sink is credited only as far as the least-credited source that reaches it.
     const level = Math.min(held.level, f.level);
     const also = [...(held.also || []), ...(f.also || [])];
+    const routes = held.routes && f.routes ? mergeRoutes(held.routes, f.routes) : null;
     if (f.hops < held.hops) Object.assign(held, f, { sources: held.sources });
     held.level = level;
     if (also.length) held.also = also;
+    if (routes) held.routes = routes;
   }
   // A use one source's route reaches unchecked, and the report leaves out for another use of the same
   // index, still limits how far a finding at that use is credited.
@@ -513,7 +535,8 @@ export function scan(root, opts = {}) {
       // happened to compute the right answer for the whole report - it ORs filesOverBudget in
       // separately - so nothing was wrong downstream, and nothing would have been until someone
       // called this set on its own and believed a silence.
-      coverageIncomplete: (res.stats.overBudget || 0) > 0
+      coverageIncomplete: (res.stats.files === 0 && directoryTree(root, opts).list().length === 0)
+        || (res.stats.overBudget || 0) > 0
         || (res.stats.filesNotReached || 0) > 0
         || (res.stats.unreadable || 0) > 0
         || (res.stats.threw || 0) > 0
@@ -552,6 +575,8 @@ export function scan(root, opts = {}) {
   return report;
 }
 
+export const scan = (root, opts = {}) => drive(scanSteps(root, opts));
+
 // Findings counted by the transaction or job that reaches them: the unit a mainframe team triages
 // in. A finding several entries reach counts under each.
 export function rollup(findings) {

package/lib/sets/hlasm.mjs

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Assembler stubs are where a COBOL estate does what COBOL cannot: switch to supervisor state, reach
+// another address space, run an instruction whose length or mask is decided at run time. This set
+// reads HLASM source as cards and reports those operations where they are written. It does not
+// assemble: macros are not expanded and conditional assembly is not evaluated (lib/hlasm.mjs).
+//
+// It also answers the question the COBOL side cannot: a CALL 'SUBRTN' with no COBOL program of that
+// name may be an assembler module, and a CSECT or ENTRY of that name here is where it is.
+import { basename, extname } from 'node:path';
+import { inScope, isAssembler, isProgram, relPath, HLASM_EXT, COPY_EXT } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { readHlasm, OPERATIONS } from '../hlasm.mjs';
+import { readHlasmStatements, parseHlasmStatement, NAMED_MACROS } from '../hlasm/read.mjs';
+import { macroOperands, splitOperands } from '../hlasm/operands.mjs';
+
+export const HLASM_RULES = {
+  'hlasm-supervisor-state-change': {
+    sev: 'crit', evidence: 'construct', cwe: 'CWE-250',
+    text: 'Assembler source switches to PSW key zero or supervisor state',
+    impact: 'The code after the switch runs with the operating system\'s authority: it can read and change any storage, so a flaw in it is a flaw in the system rather than in one job',
+    remedy: 'Keep the authorized code to the instructions that need it, return to the caller\'s key and problem state straight after (MODESET KEY=NZERO, MODE=PROB), and APF-authorize the module only where it has to be',
+  },
+  'hlasm-executes-built-instruction': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-119',
+    text: 'Assembler source runs an instruction whose length or mask comes from a register at run time',
+    impact: 'EX and EXRL run their target instruction with its second byte taken from a register, which for a move is its length: a length from input moves past the end of the field it was meant for',
+    remedy: 'Bound the register against the target field\'s length before the EX, and keep the target instruction out of the code a caller can reach any other way',
+  },
+  'hlasm-cross-memory-service': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-668',
+    text: 'Assembler source uses a cross-memory instruction, reaching another address space or another authority',
+    impact: 'A program call, a program transfer or a change of secondary address space moves execution or data access across address spaces, under the authority the linkage tables grant rather than the caller\'s own',
+    remedy: 'Confirm the entry tables and authorization indexes grant only the address spaces and keys the service needs, and that every PC routine validates what its caller passes',
+  },
+  'hlasm-runtime-module-name': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-470',
+    text: 'Assembler source loads or calls a module whose name it reads from storage at run time',
+    impact: 'EPLOC= and DE= give LINK, XCTL, LOAD and ATTACH the address of the name rather than the name, so whatever writes that storage chooses the program that runs, with the caller\'s authority',
+    remedy: 'Name the module with EP= where it is fixed; where it must vary, check the name against a list of the modules the program may run before the call',
+  },
+  'hlasm-calls-security-product': { sev: 'info', evidence: 'context', cwe: null, text: 'Assembler source calls the security product directly' },
+  'hlasm-provides-called-module': { sev: 'info', evidence: 'context', cwe: null, text: 'An assembler CSECT or ENTRY is a module a COBOL program in this tree CALLs' },
+};
+
+const RULE_OF_CLASS = {
+  'cross-memory': 'hlasm-cross-memory-service',
+  'built-instruction': 'hlasm-executes-built-instruction',
+  'security-product': 'hlasm-calls-security-product',
+};
+
+const STATE = { KEY: 'PSW key zero', EXTKEY: 'PSW key zero', MODE: 'supervisor state' };
+
+const where = (use) => (use.inMacro ? ' It is in a macro definition, so it is in every program that uses the macro.' : '');
+
+// EX and EXRL name their target instruction; when it is labelled in the same file, the finding says
+// which instruction runs with the register's length or mask.
+function executed(use, labels) {
+  if (use.class !== 'built-instruction') return '';
+  const target = (splitOperands(use.field || '')[1] || '').trim().toUpperCase();
+  const t = /^[A-Z$#@_][A-Z0-9$#@_]*$/.test(target) ? labels.get(target) : null;
+  return t ? ` runs ${t.operation}${t.field ? ` ${t.field}` : ''}` : '';
+}
+
+function detail(use, labels) {
+  const written = `${use.name}${use.field ? ` ${use.field}` : ''}${executed(use, labels)}`;
+  if (use.class === 'security-product') {
+    const request = /\bREQUEST=([A-Z]+)/i.exec(use.field || '');
+    return `${request ? `${use.name} REQUEST=${request[1].toUpperCase()}` : use.name} calls the security product from assembler rather than through a service that checks on the program's behalf.${where(use)}`;
+  }
+  return `${written}: ${OPERATIONS.get(use.name).summary}${where(use)}`;
+}
+
+// A COBOL CALL of a literal name, outside comment lines. A membership question over every program,
+// answered with a regular expression as lib/sets/jcl.mjs answers PROGRAM-ID.
+const CALL = /\bCALL\s+['"]([A-Z0-9$#@_-]{1,30})['"]/gi;
+
+function cobolCalls(source) {
+  const calls = [];
+  source.split(/\r?\n/).forEach((text, i) => {
+    if (text.length > 6 && '*/'.includes(text[6])) return;
+    for (const m of text.matchAll(CALL)) calls.push({ name: m[1].toUpperCase(), line: i + 1 });
+  });
+  return calls;
+}
+
+export function scanHlasm(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const all = tree.list().filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0, assemblerFiles: 0, bmsFiles: 0, imsFiles: 0, unrecognisedFiles: 0, readNotAssembled: true };
+  const members = new Set(all.filter((f) => [...HLASM_EXT, ...COPY_EXT].some((e) => f.toLowerCase().endsWith(e))).map((f) => basename(f, extname(f)).toUpperCase()));
+  const refused = {};
+  const macroCalls = new Map();
+  const copyNotFound = new Set();
+  // Counts, for the coverage it reports, what the statement reader refused and which macros and COPY
+  // members a file uses.
+  function readStatements(src, path) {
+    const labels = new Map();
+    for (const st of readHlasmStatements(src).statements) {
+      if (st.inMacro) continue;
+      if (st.kind === 'statement' && st.name && !st.name.startsWith('&') && !st.name.startsWith('.')) labels.set(st.name.toUpperCase(), st);
+      const res = parseHlasmStatement(st);
+      if (res.status === 'unparsed' || res.status === 'unknown') (refused[res.kind] ||= { count: 0, first: `${path}:${st.line}` }).count++;
+      const name = res.kind === 'MACRO CALL' ? st.operation : NAMED_MACROS.has(res.kind) ? res.kind : null;
+      if (name) {
+        const m = macroCalls.get(name) || { name, calls: 0, definedInTree: members.has(name) };
+        m.calls++;
+        macroCalls.set(name, m);
+      }
+      if (res.kind === 'COPY') {
+        const member = String(res.status === 'parsed' ? res.node.member : (/^\s*([A-Z$#@][A-Z0-9$#@_]*)/i.exec(st.field || '') || [])[1] || '').toUpperCase();
+        if (member && !members.has(member)) copyNotFound.add(member);
+      }
+    }
+    return labels;
+  }
+  const defines = new Map();
+
+  const run = eachWithinMemory(all.filter(isAssembler), (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const r = readHlasm(src);
+    if (r.kind === 'bms') { stats.bmsFiles++; return src.length; }
+    if (r.kind === 'ims') { stats.imsFiles++; return src.length; }
+    if (r.kind === 'unrecognised') { stats.unrecognisedFiles++; return src.length; }
+    stats.assemblerFiles++;
+    const path = relPath(root, f);
+    for (const d of r.defines) if (!defines.has(d.name)) defines.set(d.name, { ...d, path });
+    const labels = readStatements(src, path);
+    for (const use of r.operations) {
+      if (use.class === 'module-load') {
+        const { keywords } = macroOperands(use.field || '');
+        const at = keywords.has('EPLOC') ? 'EPLOC' : keywords.has('DE') ? 'DE' : null;
+        if (at) findings.push({ rule: 'hlasm-runtime-module-name', path, line: use.line, detail: `${use.name} ${at}=${keywords.get(at)} names the module by the address of its name, so the program that runs is whatever name that storage holds.${where(use)}` });
+        continue;
+      }
+      if (use.name === 'MODESET') {
+        if (use.stateChange) findings.push({ rule: 'hlasm-supervisor-state-change', path, line: use.line, detail: `MODESET ${use.stateChange} switches to ${STATE[use.stateChange.split('=')[0]]}.${where(use)}` });
+        continue;
+      }
+      const rule = RULE_OF_CLASS[use.class];
+      if (rule) findings.push({ rule, path, line: use.line, detail: detail(use, labels) });
+    }
+    return src.length;
+  }, { label: 'hlasm', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  if (defines.size) {
+    const callers = new Map();
+    const programs = eachWithinMemory(all.filter(isProgram), (f) => {
+      let src;
+      try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+      for (const c of cobolCalls(src)) {
+        if (!defines.has(c.name)) continue;
+        if (!callers.has(c.name)) callers.set(c.name, []);
+        callers.get(c.name).push({ path: relPath(root, f), line: c.line });
+      }
+      return src.length;
+    }, { label: 'hlasm-callers', maxBytes: opts.maxSourceBytes ?? Infinity });
+    if (programs.skipped.length) stats.callersNotRead = programs.skipped.length;
+    for (const [name, calls] of callers) {
+      const d = defines.get(name);
+      const first = calls[0];
+      findings.push({ rule: 'hlasm-provides-called-module', path: d.path, line: d.line,
+        detail: `${d.how} ${name} is the module CALL '${name}' reaches from ${first.path}:${first.line}${calls.length > 1 ? ` and ${calls.length - 1} other CALL${calls.length > 2 ? 's' : ''}` : ''}` });
+    }
+  }
+
+  // Each statement the reader refused, each macro whose expansion was not read and each COPY member
+  // the tree does not hold is named: an operation inside any of them is one this set did not see.
+  if (Object.keys(refused).length) { stats.statementsNotRead = refused; stats.coverageIncomplete = true; }
+  if (copyNotFound.size) { stats.copyNotFound = [...copyNotFound].sort(); stats.coverageIncomplete = true; }
+  if (macroCalls.size) stats.macrosNotExpanded = [...macroCalls.values()].sort((a, b) => b.calls - a.calls || a.name.localeCompare(b.name)).slice(0, 50);
+  return report('hlasm', { rules: HLASM_RULES, findings, stats, run });
+}

package/lib/sets/jcl.mjs

@@ -3,10 +3,11 @@
 // authority, against which dataset; an in-stream SYSIN carries commands that never appear in any
 // program the scanner reads. The 2026-09-18 evaluation counted 27 JCL files carrying RACF or
 // IDCAMS commands in-stream, so this is where a repository's privileged surface actually lives.
-import { inScope, isJcl, isProgram, relPath } from '../sources.mjs';
+import { inScope, isAssembler, isJcl, isProgram, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
+import { readHlasm } from '../hlasm.mjs';
 import { ddGroups, tsoCommands } from '../utilities.mjs';
 import { ftpSession } from '../ftp.mjs';
 import { loadSite, productionQualifierOf, SITE_FILE } from '../site.mjs';
@@ -228,12 +229,25 @@ function programIds(tree, files, unread) {
   return ids;
 }
 
+// The modules assembler source in the tree defines: each CSECT and ENTRY name, which a step can run
+// as it runs a COBOL program.
+function assemblerModules(tree, files, unread) {
+  const names = [];
+  for (const f of files) {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { unread.push(`${tree.rel(f)}: ${e.code || e.name}`); continue; }
+    for (const d of readHlasm(src).defines) names.push(d.name);
+  }
+  return names;
+}
+
 export function scanJcl(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const jclFiles = all.filter(isJcl);
   const programsUnread = [];
   const defined = programIds(tree, all.filter(isProgram), programsUnread);
+  for (const name of assemblerModules(tree, all.filter(isAssembler), programsUnread)) defined.add(name);
 
   // A vendor product supplies its own utilities. An estate that has loaded the pack for a product
   // is telling us those programs exist, so reporting them as undefined would be a false positive