@portll/cobolwork 0.5.0 → 0.6.0

package/rules/gitleaks-mainframe.toml

@@ -6,51 +6,72 @@ title = "commitwork mainframe credential rules"
 [extend]
 useDefault = false
 
+# A rule with two capture groups and no secretGroup reports whichever group matched: a password
+# written plain, or one in apostrophes, which a password phrase or a special character needs. A value
+# in apostrophes that reaches column 71 continues on the next statement, so its first part is reported.
 [[rules]]
 id = "jcl-racf-password"
-description = "RACF password in a JCL statement (JOB card, EXEC PARM or DD)"
-regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\(?([A-Z0-9@#$]{1,8})(?:[,)'\s]|$)'''
-secretGroup = 1
+description = "RACF password or password phrase in a JCL statement (JOB card, EXEC PARM or DD)"
+regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\(?(?:([A-Z0-9@#$]{1,8})(?:[,)'\s]|$)|'((?:[^'\n]|'')+)(?:'|$))'''
 keywords = ["password="]
 [rules.allowlist]
-regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?|&[A-Z0-9@#$]{1,8}\.?|(?:your[-_ ]?)?pass(?:word)?[-_ ]?phrase)$''']
 
 [[rules]]
 id = "jcl-racf-new-password"
-description = "New RACF password in a JCL PASSWORD=(old,new)"
-regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\([A-Z0-9@#$]{1,8},([A-Z0-9@#$]{1,8})\)'''
-secretGroup = 1
+description = "New RACF password or password phrase in a JCL PASSWORD=(old,new)"
+regex = '''(?im)^//[^*\n][^\n]*?\bPASSWORD=\((?:[A-Z0-9@#$]{1,8}|'(?:[^'\n]|'')*'),(?:([A-Z0-9@#$]{1,8})\)|'((?:[^'\n]|'')+)(?:'\)|$))'''
 keywords = ["password="]
 [rules.allowlist]
-regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?|&[A-Z0-9@#$]{1,8}\.?|(?:your[-_ ]?)?pass(?:word)?[-_ ]?phrase)$''']
 
 [[rules]]
 id = "tso-logon-password"
 description = "TSO LOGON with an inline password"
-regex = '''(?im)^\s*LOGON\s+[A-Z@#$][A-Z0-9@#$]{0,7}/([A-Z0-9@#$]{1,8})\b'''
+regex = '''(?im)^\s*LOGON\s+[A-Z@#$][A-Z0-9@#$]{0,7}[ \t,]*/[ \t,]*([A-Z0-9@#$]{1,8})\b'''
 secretGroup = 1
 keywords = ["logon"]
 [rules.allowlist]
 regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
 
 [[rules]]
-id = "racf-command-password"
-description = "RACF ADDUSER or ALTUSER with an inline PASSWORD(...)"
-regex = '''(?i)\b(?:ALTUSER|ALU|ADDUSER|AU)\s+\(?[A-Z0-9@#$]{1,8}\)?[^\n]*?\bPASSWORD\(\s*([A-Z0-9@#$]{1,8})\s*\)'''
+id = "tso-logon-new-password"
+description = "New password in a TSO LOGON userid/password/new-password"
+regex = '''(?im)^\s*LOGON\s+[A-Z@#$][A-Z0-9@#$]{0,7}[ \t,]*/[ \t,]*[A-Z0-9@#$]{1,8}[ \t,]*/[ \t,]*([A-Z0-9@#$]{1,8})\b'''
 secretGroup = 1
-keywords = ["password("]
+keywords = ["logon"]
 [rules.allowlist]
 regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
 
+[[rules]]
+id = "racf-command-password"
+description = "RACF ADDUSER, ALTUSER, PASSWORD or PHRASE command with an inline password or password phrase"
+regex = '''(?im)(?:\b(?:ALTUSER|ALU|ADDUSER|AU)\s+\(?[A-Z0-9@#$]{1,8}\)?[^\n]*?|^\s*(?:PASSWORD|PW|PHRASE)\s+(?:[^\n]*?\s)?)\b(?:PASSWORD\(\s*([A-Z0-9@#$]{1,8})(?:\s*\)|\s+[A-Z0-9@#$]{1,8}\s*\))|PHRASE\(\s*'((?:[^'\n]|'')+)'(?:\s*\)|\s+'(?:[^'\n]|'')*'\s*\)))'''
+keywords = ["password(", "phrase("]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?|(?:your[-_ ]?)?pass(?:word)?[-_ ]?phrase)$''']
+
+[[rules]]
+id = "racf-command-new-password"
+description = "New password or password phrase in a RACF PASSWORD or PHRASE command"
+regex = '''(?im)^\s*(?:PASSWORD|PW|PHRASE)\s+(?:[^\n]*?\s)?\b(?:PASSWORD\(\s*[A-Z0-9@#$]{1,8}\s+([A-Z0-9@#$]{1,8})\s*\)|PHRASE\(\s*'(?:[^'\n]|'')*'\s+'((?:[^'\n]|'')+)'\s*\))'''
+keywords = ["password(", "phrase("]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?|(?:your[-_ ]?)?pass(?:word)?[-_ ]?phrase)$''']
+
+# Column 7 holds the indicator: '*' and '/' make the line a comment, and 'D' a debugging line, which
+# is still source. A literal that runs to the end of its line is continued on the next, so the first
+# part is enough to report it. A hexadecimal value under four bytes is a flag, and one byte repeated
+# is a fill.
 [[rules]]
 id = "cobol-value-credential"
 description = "COBOL data item named for a credential with a literal VALUE"
-regex = '''(?im)^[^*\n]{0,7}\s*\b(?:0?[1-9]|[1-4][0-9]|77)\s+[A-Z0-9-]*(?:PASSWORD|PASSWD|PASSWRD|PSWD|PWD|SECRET|APIKEY|API-KEY|ACCESS-KEY|(?:API|ACCESS|AUTH|BEARER|OAUTH|REFRESH)-?TOKEN)[A-Z0-9-]*\b[^.]*?\bVALUES?\s+(?:IS\s+|ARE\s+)?(?:'([^'\n]{1,})'|"([^"\n]{1,})")'''
+regex = '''(?im)^(?:(?:[^*\n]{0,6}|[^*\n]{6}[^*/\n])\s*\b|[^*\n]{6}[Dd])(?:0?[1-9]|[1-4][0-9]|77)\s+[A-Z0-9-]*(?:PASSWORD|PASSWD|PASSWRD|PSWD|PWD|SECRET|APIKEY|API-KEY|ACCESS-KEY|(?:API|ACCESS|AUTH|BEARER|OAUTH|REFRESH)-?TOKEN)[A-Z0-9-]*\b[^.]*?\bVALUES?\s+(?:IS\s+|ARE\s+)?(?:NX|UX|[XNGZU])?(?:'([^'\n]{1,})(?:'|$)|"([^"\n]{1,})(?:"|$))'''
 keywords = ["password", "passwd", "passwrd", "pswd", "pwd", "secret", "apikey", "api-key", "access-key", "token"]
 path = '''(?i)\.(?:cbl|cob|cobol|cpy|copy|sqb|pco|ccp)$'''
 [rules.allowlist]
 regexTarget = "match"
-regexes = ['''(?i)VALUE\s+(?:IS\s+)?['"](?:x+|\*+|\s+|y|n|yes|no|true|false|on|off|[01]|pass(?:word)?|secret|dummy|changeme|password:?|enter[^'"]*|invalid[^'"]*|wrong[^'"]*|[^'"]*\S\s+\S[^'"]*)['"]''']
+regexes = ['''(?i)VALUES?\s+(?:IS\s+|ARE\s+)?(?:NX|UX|[XNGZU])?['"](?:x+|\*+|\s+|y|n|yes|no|true|false|on|off|[01]|pass(?:word)?|secret|dummy|changeme|password:?|enter[^'"]*|invalid[^'"]*|wrong[^'"]*|[^'"]*\S\s+\S[^'"]*)(?:['"]|$)''', '''(?i)VALUES?\s+(?:IS\s+|ARE\s+)?(?:NX|UX|X)['"](?:[0-9A-F]{1,7}|0+|(?:40)+|(?:20)+|F+|(?:F0)+)['"]''']
 
 [[rules]]
 id = "embedded-sql-connect-password"
@@ -69,3 +90,13 @@ secretGroup = 1
 keywords = ["password("]
 [rules.allowlist]
 regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']
+
+# PHRASE and NEWPHRASE take a data area, which cannot be a literal, so only NEWPASSWORD can hold one.
+[[rules]]
+id = "cics-new-password"
+description = "EXEC CICS SIGNON or CHANGE PASSWORD with a literal NEWPASSWORD"
+regex = '''(?i)EXEC\s+CICS\s+(?:SIGNON|CHANGE)\b[^.]{0,300}?\bNEWPASSWORD\(\s*'([^'\n]{1,8})'\s*\)'''
+secretGroup = 1
+keywords = ["newpassword("]
+[rules.allowlist]
+regexes = ['''(?i)^(?:x+|\*+|y+|n+|pass|passw(?:or)?d?|pwd|secret|dummy|changeme|password|newpass(?:word)?|oldpass(?:word)?)$''']