@portll/cobolwork 0.4.0 → 0.6.0

package/lib/sets/log.mjs

@@ -23,7 +23,7 @@ import { parseJcl } from '../jcl.mjs';
 import { compileStepOptions } from '../options.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 
 
 export const LOG_RULES = {
@@ -337,7 +337,7 @@ const memberOf = (file) => basename(String(file || ''), extname(String(file || '
 const runByJob = (batch, p, file) => batch.unsure
   || [String(p.id || '').toUpperCase(), memberOf(file)].some((n) => n && (batch.runs.has(n) || batch.runs.has(n.slice(0, 8))));
 
-export function scanLog(root, opts = {}) {
+export function* scanLogSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isProgram).filter(inScope(opts));
   const findings = [];
@@ -364,7 +364,7 @@ export function scanLog(root, opts = {}) {
     return { rule: 'display-echoes-a-credential', detail: `${p.id} shows ${w.name} on the terminal to the person who typed it: not a log, but the screen and its scrollback keep it` };
   };
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     // Every EXEC CICS WRITE form, not the two this set started with. WRITE OPERATOR was added as a
@@ -404,3 +404,5 @@ export function scanLog(root, opts = {}) {
 
   return report('log', { rules: LOG_RULES, findings, stats, run });
 }
+
+export const scanLog = (root, opts = {}) => drive(scanLogSteps(root, opts));

package/lib/sets/priv.mjs

@@ -19,7 +19,7 @@
 import { inScope, isProgram, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { parseCsd } from '../csd.mjs';
 import { parseJcl } from '../jcl.mjs';
 import { loadSite } from '../site.mjs';
@@ -101,7 +101,7 @@ function under(dsn, prefixes) {
   });
 }
 
-export function scanPriv(root, opts = {}) {
+export function* scanPrivSteps(root, opts = {}) {
   const site = loadSite(root, opts.site || null, opts.tree);
   const tree = treeFor(root, opts);
   const files = tree.list().filter(inScope(opts));
@@ -140,7 +140,7 @@ export function scanPriv(root, opts = {}) {
   const diagnostics = [];
   const uss = [];
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     const path = relPath(root, f);
@@ -320,3 +320,5 @@ export function scanPriv(root, opts = {}) {
 
   return report('priv', { rules: PRIV_RULES, findings, stats, run });
 }
+
+export const scanPriv = (root, opts = {}) => drive(scanPrivSteps(root, opts));

package/lib/sets/secrets.mjs

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Credentials written into COBOL source. The shapes are the ones rules/gitleaks-mainframe.toml gives
+// gitleaks, read from that file, so one list serves both and the build gate does not depend on
+// gitleaks being installed. Go's RE2 syntax is taken only where it means the same in JavaScript; any
+// other construct is refused when the file is read.
+import { readFileSync } from 'node:fs';
+import { inScope, isProgram, isCopybook, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+
+export const SECRETS_RULES = {
+  'credential-in-source': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-798', measured: false,
+    text: 'A credential is written into the source',
+    impact: 'Everyone who can read the source, its history or a listing can sign on with it, and changing it means changing and redeploying the program',
+    remedy: 'Read the credential at run time from where the site keeps them (a RACF-protected data set, a PassTicket, a Db2 trusted context or a CICS-supplied identity), and change the one already exposed',
+  },
+};
+
+// The TOML ids of the shapes that occur in COBOL programs and copybooks, and how a finding names each.
+const SHAPES = {
+  'cobol-value-credential': (m) => `${dataName(m) || 'a data item named for a credential'} has a literal VALUE`,
+  'embedded-sql-connect-password': () => 'EXEC SQL CONNECT gives a literal password',
+  'cics-signon-password': (m) => `EXEC CICS ${/\b(SIGNON|VERIFY|CHANGE)\b/i.exec(m)[1].toUpperCase()} gives a literal PASSWORD`,
+  'cics-new-password': (m) => `EXEC CICS ${/\b(SIGNON|CHANGE)\b/i.exec(m)[1].toUpperCase()} gives a literal NEWPASSWORD`,
+};
+
+const dataName = (m) => (/\b(?:0?[1-9]|[1-4][0-9]|77)\s+([A-Z0-9][A-Z0-9-]*)/i.exec(m) || [])[1]?.toUpperCase();
+
+const value = (raw) => {
+  const t = raw.trim();
+  if (t.startsWith("'''")) return t.slice(3, t.lastIndexOf("'''"));
+  if (t.startsWith('"')) return JSON.parse(t);
+  if (t.startsWith('[')) return [...t.matchAll(/'''(.*?)'''|"((?:[^"\\]|\\.)*)"/g)].map((x) => x[1] ?? JSON.parse(`"${x[2]}"`));
+  if (/^\d+$/.test(t)) return Number(t);
+  if (t === 'true' || t === 'false') return t === 'true';
+  throw new Error(`gitleaks-mainframe.toml: value not read: ${t}`);
+};
+
+// The [[rules]] tables of the file, each with its allowlist folded in.
+export function readToml(text) {
+  const rules = [];
+  let into = null;
+  for (const line of text.split('\n')) {
+    const l = line.trim();
+    if (!l || l.startsWith('#')) continue;
+    if (l === '[[rules]]') { rules.push((into = { allowlist: {} })); continue; }
+    if (l === '[rules.allowlist]') { into = rules.at(-1).allowlist; continue; }
+    if (l.startsWith('[')) { into = null; continue; }
+    const kv = /^([A-Za-z]+)\s*=\s*(.+)$/.exec(l);
+    if (kv && into) into[kv[1]] = value(kv[2]);
+  }
+  return rules;
+}
+
+// A gitleaks regex as a JavaScript one: a leading (?flags) group becomes the flags.
+export function jsRegex(re, extra = '') {
+  const lead = /^\(\?([ims]+)\)/.exec(re);
+  const body = lead ? re.slice(lead[0].length) : re;
+  if (/\(\?[a-zA-Z]|\(\?P<|\\[AzZpPQE]/.test(body)) throw new Error(`gitleaks-mainframe.toml: no JavaScript equivalent for ${re}`);
+  return new RegExp(body, [...new Set([...(lead ? lead[1] : ''), ...extra])].join(''));
+}
+
+const secretOf = (m, group) => (group ? m[group] : m.slice(1).find((g) => g !== undefined)) ?? m[0];
+
+export const SHAPE_RULES = readToml(readFileSync(new URL('../../rules/gitleaks-mainframe.toml', import.meta.url), 'utf8'))
+  .filter((r) => r.id in SHAPES)
+  .map((r) => ({
+    id: r.id,
+    pattern: jsRegex(r.regex, 'g'),
+    secretGroup: r.secretGroup || 0,
+    keywords: (r.keywords || []).map((k) => k.toLowerCase()),
+    allow: (r.allowlist.regexes || []).map((x) => jsRegex(x)),
+    allowTarget: r.allowlist.regexTarget || 'secret',
+  }));
+
+// Every shape in the text, at the line its first non-blank character is on.
+export function credentialsIn(text) {
+  const lower = text.toLowerCase();
+  const out = [];
+  for (const s of SHAPE_RULES) {
+    if (s.keywords.length && !s.keywords.some((k) => lower.includes(k))) continue;
+    for (const m of text.matchAll(s.pattern)) {
+      const target = s.allowTarget === 'match' ? m[0] : secretOf(m, s.secretGroup);
+      if (s.allow.some((a) => a.test(target))) continue;
+      const start = m.index + (m[0].length - m[0].trimStart().length);
+      out.push({ shape: s.id, line: text.slice(0, start).split('\n').length, detail: SHAPES[s.id](m[0]) });
+    }
+  }
+  return out;
+}
+
+export function scanSecrets(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter((f) => isProgram(f) || isCopybook(f)).filter(inScope(opts));
+  const findings = [];
+  const stats = { filesScanned: 0, filesUnreadable: 0 };
+
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const c of credentialsIn(src)) findings.push({ rule: 'credential-in-source', path, line: c.line, detail: `${c.detail} (${c.shape})` });
+    return src.length;
+  }, { label: 'secrets', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  return report('secrets', { rules: SECRETS_RULES, findings, stats, run });
+}

package/lib/sets/semantics.mjs

@@ -9,7 +9,7 @@ import { basename, extname } from 'node:path';
 import { inScope, isProgram, isJcl, relPath, ebcdicByte } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { loadSite } from '../site.mjs';
 import { parseJcl } from '../jcl.mjs';
 import { optionCards, optionTokens, compileStepOptions } from '../options.mjs';
@@ -206,7 +206,7 @@ function thruPairs(toks) {
 }
 const WHEN_WORDS = new Set(['THRU', 'THROUGH', 'ALSO', 'OR', 'NOT', 'ANY', 'OTHER', 'TRUE', 'FALSE']);
 
-export function scanSemantics(root, opts = {}) {
+export function* scanSemanticsSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const files = all.filter(isProgram);
@@ -359,7 +359,7 @@ export function scanSemantics(root, opts = {}) {
     }
   }
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     let r;
@@ -375,3 +375,5 @@ export function scanSemantics(root, opts = {}) {
 
   return report('semantics', { rules: SEMANTICS_RULES, findings, stats, run });
 }
+
+export const scanSemantics = (root, opts = {}) => drive(scanSemanticsSteps(root, opts));

package/lib/sets/web.mjs

@@ -22,7 +22,7 @@ import { parseCsd } from '../csd.mjs';
 import { classify } from './log.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 
 
 export const WEB_RULES = {
@@ -62,6 +62,18 @@ export const WEB_RULES = {
     impact: 'The TCPIPSERVICE takes connections on a port with SSL off, so everything the session carries - the 3270 data stream, a SOAP body, a credential on a sign-on screen - crosses the network in the clear and can be read or changed in flight',
     remedy: 'Set SSL(YES) and name a certificate on the TCPIPSERVICE, or front it with a TLS-terminating proxy the estate controls and restrict the port to that proxy',
   },
+  'web-client-opens-cleartext': {
+    sev: 'med', evidence: 'construct', cwe: 'CWE-319',
+    text: 'A program opens an outbound HTTP connection without TLS',
+    impact: 'WEB OPEN asks for HTTP rather than HTTPS, so the request the program sends and the response it reads cross the network in the clear, readable and changeable in flight, unless an AT-TLS policy outside the program encrypts them',
+    remedy: 'Open the connection with HTTPS, or through a client URIMAP with SCHEME(HTTPS); where AT-TLS secures it, use a URIMAP with ATTLS(AWARE) so the program fails rather than send in the clear',
+  },
+  'web-receive-length-exceeds-area': {
+    sev: 'high', evidence: 'construct', cwe: 'CWE-805',
+    text: 'A web receive lets CICS write more bytes than the area it writes into',
+    impact: 'CICS copies up to MAXLENGTH bytes of the body into the INTO area, so a body longer than the area, which the other end of the connection chooses, overwrites the storage after it',
+    remedy: 'Pass a MAXLENGTH no greater than the INTO area, or LENGTH OF that area',
+  },
   'web-link-opens-without-noopener': {
     sev: 'low', evidence: 'construct', cwe: 'CWE-1022',
     text: 'A program writes a link that opens a new window with a handle back to this one',
@@ -92,6 +104,18 @@ function execOptions(exec) {
   return { opts, words };
 }
 
+// The options written outside any parentheses, which is where a CVDA keyword such as HTTP or HTTPS
+// stands; a word inside an operand is a data name.
+function keywords(exec) {
+  const out = new Set();
+  let depth = 0;
+  for (const t of exec.toks) {
+    if (t.t === 'sep') depth += t.v === '(' ? 1 : t.v === ')' ? -1 : 0;
+    else if (t.t === 'word' && depth === 0) out.add(t.u);
+  }
+  return out;
+}
+
 // A header name or value is only knowable when the program wrote it as a literal. NAME(WS-HDR-NAME)
 // names a field whose contents this rule set cannot see, and a rule that guessed would be inventing
 // evidence, so the statement is counted as unreadable and reported as coverage, not as a pass.
@@ -144,7 +168,7 @@ const HTTP_METHOD = /^(GET|POST|PUT|PATCH|DELETE)$/i;
 // the absence and the explicit NO are one finding, and PROTOCOL only changes what is in the clear.
 const encrypted = (svc) => /^(YES|CLIENTAUTH|CLIENTCERT)$/i.test(String(svc.ssl || ''));
 
-export function scanWeb(root, opts = {}) {
+export function* scanWebSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const files = all.filter(isProgram);
@@ -152,6 +176,7 @@ export function scanWeb(root, opts = {}) {
   const stats = {
     filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0,
     webPrograms: 0, headersWritten: 0, headersComputed: 0, htmlResponses: 0, listenersDefined: 0,
+    outboundOpens: 0, opensUndecided: 0,
   };
   const where = (x, path) => ({ path: x.file ? relPath(root, x.file) : path, line: x.line || 1 });
 
@@ -161,12 +186,53 @@ export function scanWeb(root, opts = {}) {
     const cookies = [];
     let computedHeaders = 0;
 
+    const opens = [];              // every outbound WEB OPEN, and what it says about TLS
+    const receives = [];           // every receive into an area with a length it can be judged by
+    const item = (name) => p.items.find((i) => i.name === name);
+    // A variable naming a URIMAP or a host usually holds one literal from its VALUE clause.
+    const valueOf = (toks) => {
+      if (!toks || !toks.length) return null;
+      const lit = literalOf(toks);
+      if (lit !== null) return lit.trim();
+      const it = toks[0].t === 'word' ? item(toks[0].u) : null;
+      const v = it && it.values && it.values.find((x) => x.t === 'lit');
+      return v ? String(v.v).trim() : null;
+    };
+    // MAXLENGTH as a literal, or LENGTH OF an item. A data item's value can change before the
+    // command runs, so it is not judged.
+    const lengthOf = (toks) => {
+      if (!toks || !toks.length) return null;
+      if (toks.length === 1 && (toks[0].t === 'num' || /^\d+$/.test(String(toks[0].v)))) return { bytes: Number(toks[0].v), written: String(toks[0].v) };
+      if (toks.length >= 3 && toks[0].u === 'LENGTH' && toks[1].u === 'OF' && toks[2].t === 'word') {
+        const it = item(toks[2].u);
+        return it && it.size ? { bytes: it.size, written: `LENGTH OF ${toks[2].u}` } : null;
+      }
+      return null;
+    };
+
     for (const e of p.execs) {
       if (e.kind !== 'CICS') continue;
       const { opts: o, words: w } = execOptions(e);
       if (!w.includes('WEB') && !w.includes('DOCUMENT')) continue;
       const at = where(e, path);
 
+      if (w[0] === 'WEB' && w[1] === 'OPEN') {
+        const k = keywords(e);
+        // SCHEME(HTTPS) and SCHEME(DFHVALUE(HTTPS)) name the CVDA as the keyword does; any other
+        // operand is a field whose value is set at run time.
+        const named = (o.get('SCHEME') || []).map((t) => t.u);
+        const cvda = named.length && named.every((x) => ['DFHVALUE', 'HTTP', 'HTTPS'].includes(x)) ? named.find((x) => x !== 'DFHVALUE') : null;
+        opens.push({ at, https: k.has('HTTPS') || cvda === 'HTTPS', http: k.has('HTTP') || cvda === 'HTTP',
+          urimap: o.has('URIMAP') ? valueOf(o.get('URIMAP')) : undefined, host: o.has('HOST') ? valueOf(o.get('HOST')) : null });
+        continue;
+      }
+      if (w[0] === 'WEB' && (w[1] === 'RECEIVE' || w[1] === 'CONVERSE') && o.has('INTO')) {
+        const into = o.get('INTO')[0];
+        const area = into && into.t === 'word' ? item(into.u) : null;
+        const max = lengthOf(o.get('MAXLENGTH'));
+        if (area && area.size && max) receives.push({ at, verb: w[1], area: into.u, size: area.size, max });
+      }
+
       if (w.includes('WRITE') && w.includes('HTTPHEADER')) {
         const name = literalOf(o.get('HTTPHEADER') || o.get('NAME'));
         const value = literalOf(o.get('VALUE'));
@@ -228,19 +294,23 @@ export function scanWeb(root, opts = {}) {
     });
     const testsMethod = conditions.some((c) => c.some((t) => t.t === 'lit' && HTTP_METHOD.test(String(t.v).trim())));
 
-    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod };
+    return { headers, sends, cookies, computedHeaders, docText, looksHtml, id: p.id, uris, built, webRequest, changes, comparesToken, testsMethod, opens, receives };
   }
 
   // The listener that accepts the request these responses answer. It is defined in a CSD rather
   // than in a program, so this reads every file the way lib/sets/priv.mjs does: a DFHCSDUP listing
   // is named whatever the estate named it, and filtering on an extension is how a BMS count once
   // came out as zero.
+  // Client URIMAPs come from the same files: WEB OPEN URIMAP(name) takes its scheme from one.
+  const urimaps = new Map();
   for (const f of all) {
     let src;
     try { src = tree.text(f).text; } catch { continue; }
-    if (!/^\s*DEFINE\s+TCPIPSERVICE\s*\(/im.test(src)) continue;
+    if (!/^\s*DEFINE\s+(TCPIPSERVICE|URIMAP)\s*\(/im.test(src)) continue;
     const path = relPath(root, f);
-    for (const [name, svc] of parseCsd(src).tcpipservices) {
+    const csd = parseCsd(src);
+    for (const [name, u] of csd.urimaps) if (!urimaps.has(name)) urimaps.set(name, { ...u, path });
+    for (const [name, svc] of csd.tcpipservices) {
       stats.listenersDefined++;
       if (encrypted(svc)) continue;
       const carries = svc.protocol ? `${/^[AEIOU]/i.test(svc.protocol) ? 'an' : 'a'} ${svc.protocol} ` : '';
@@ -253,7 +323,7 @@ export function scanWeb(root, opts = {}) {
     }
   }
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     // The whole set is about EXEC CICS WEB and EXEC CICS DOCUMENT. Nothing else needs parsing.
@@ -269,9 +339,34 @@ export function scanWeb(root, opts = {}) {
       // outbound session or answers a web request has said something worth judging even when it
       // writes no header and sends no page.
       const anything = v.headers.length || v.sends.length || v.cookies.length || v.looksHtml
-        || v.uris.length || v.built.length || (v.webRequest && v.changes.length);
+        || v.uris.length || v.built.length || (v.webRequest && v.changes.length) || v.opens.length || v.receives.length;
       if (!anything) continue;
       stats.webPrograms++;
+
+      for (const o of v.opens) {
+        stats.outboundOpens++;
+        const to = o.host ? ` to ${o.host}` : '';
+        if (o.https) continue;
+        if (o.http) {
+          findings.push({ rule: 'web-client-opens-cleartext', ...o.at, program: v.id,
+            detail: `${v.id} opens a connection${to} asking for HTTP rather than HTTPS, so what it sends and reads crosses the network in the clear unless an AT-TLS policy outside the program encrypts it` });
+          continue;
+        }
+        const u = o.urimap ? urimaps.get(o.urimap.toUpperCase()) : null;
+        if (u && /^HTTP$/i.test(u.scheme || '') && !/^AWARE$/i.test(u.attls || '')) {
+          findings.push({ rule: 'web-client-opens-cleartext', ...o.at, program: v.id,
+            detail: `${v.id} opens a connection through URIMAP ${o.urimap.toUpperCase()}, which ${u.path}:${u.line} defines with SCHEME(HTTP)${u.host ? ` to ${u.host}` : ''} and no ATTLS(AWARE), so what it sends and reads crosses the network in the clear unless an AT-TLS policy encrypts it` });
+          continue;
+        }
+        // A scheme in a variable, or a URIMAP the tree does not define, is decided where this cannot see.
+        if (!u || !u.scheme) stats.opensUndecided++;
+      }
+
+      for (const r of v.receives) {
+        if (r.max.bytes <= r.size) continue;
+        findings.push({ rule: 'web-receive-length-exceeds-area', ...r.at, program: v.id,
+          detail: `${v.id} has WEB ${r.verb} pass up to MAXLENGTH(${r.max.written}), ${r.max.bytes} bytes, into ${r.area}, which is ${r.size} bytes` });
+      }
       stats.headersWritten += v.headers.length;
       stats.headersComputed += v.computedHeaders;
 
@@ -349,3 +444,5 @@ export function scanWeb(root, opts = {}) {
 
   return report('web', { rules: WEB_RULES, findings, stats, run });
 }
+
+export const scanWeb = (root, opts = {}) => drive(scanWebSteps(root, opts));

package/lib/sources.mjs

@@ -14,6 +14,9 @@ export const PROGRAM_EXT = ['.cbl', '.cob', '.cobol', '.sqb', '.pco'];
 export const COPY_EXT = ['.cpy', '.copy', '.inc'];
 export const JCL_EXT = ['.jcl', '.job', '.proc', '.prc', '.cntl'];
 export const BMS_EXT = ['.bms'];
+// Assembler source. A BMS map or an IMS DBD or PSB is also assembler macros, and is often named .asm;
+// lib/hlasm.mjs tells them apart by the macros they hold.
+export const HLASM_EXT = ['.asm', '.mac', '.mlc', '.hlasm', '.assemble'];
 
 const has = (list) => (p) => list.includes(extname(p).toLowerCase());
 
@@ -46,6 +49,11 @@ function kindOfHead(head) {
   // A BMS map opens its mapset with DFHMSD in the operation field. Tested last, so nothing that
   // classified before classifies differently.
   if (/^[^*\s]*[ \t]+DFHMSD(?=\s|$)/im.test(text)) return 'bms';
+  // Assembler source defines a section or a macro, and declares storage or a base register, in the
+  // operation field; either alone is a word a text file can hold. Tested after BMS, which is
+  // assembler macros too.
+  if (/^[^*\s]*[ \t]+(?:CSECT|RSECT|START|MACRO)(?=\s|$)/m.test(text)
+    && /^[^*\s]*[ \t]+(?:USING|DC|DS|BALR|BASR|STM|STMG|MEND)(?=\s|$)/m.test(text)) return 'hlasm';
   return null;
 }
 
@@ -116,10 +124,12 @@ export const isProgram = byExtOrContent(PROGRAM_EXT, 'program');
 export const isCopybook = byExtOrContent(COPY_EXT, 'copybook');
 export const isJcl = byExtOrContent(JCL_EXT, 'jcl');
 export const isBms = byExtOrContent(BMS_EXT, 'bms');
-// Not BMS, by either route: the sets that read every source file have not chosen to read maps.
+export const isAssembler = byExtOrContent(HLASM_EXT, 'hlasm');
+// Not BMS or assembler, by either route: the sets that read every source file have not chosen to
+// read maps or assembler.
 export const isSource = (p) => (extname(p)
   ? [...PROGRAM_EXT, ...COPY_EXT, ...JCL_EXT].includes(extname(p).toLowerCase())
-  : ![null, 'bms'].includes(sniffKind(p)));
+  : ![null, 'bms', 'hlasm'].includes(sniffKind(p)));
 
 // `opts.only` is about rule sets; this is about files. A rule set given an allow list reads the
 // files on it and no others.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portll/cobolwork",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "COBOL, JCL and CICS security analysis with zero runtime dependencies: reference-format parser, cross-program data flow, mainframe credential rules. Plugs into commitwork.",
   "license": "AGPL-3.0-or-later",
   "author": "Portll <john@portll.net>",