@portll/cobolwork 0.5.0 → 0.6.0

package/lib/kernel/registry.mjs

@@ -12,47 +12,50 @@
 // literal key `undefined` in every report for several commits. lib/scan.mjs grew an ESETNAME throw
 // to make the next rename fail loudly instead. The throw stays - see `reportKey` below - but the
 // map it guarded is gone, because a name derived from one place cannot disagree with itself.
-import { scan as scanFlow, RULES as FLOW_RULES } from '../sets/flow.mjs';
-import { scanCics, CICS_RULES } from '../sets/cics.mjs';
+import { scan as scanFlow, scanSteps as scanFlowSteps, RULES as FLOW_RULES } from '../sets/flow.mjs';
+import { scanCics, scanCicsSteps, CICS_RULES } from '../sets/cics.mjs';
 import { scanHidden, HIDDEN_RULES } from '../sets/hidden.mjs';
-import { scanCopybooks, COPYBOOK_RULES } from '../sets/copybook.mjs';
+import { scanCopybooks, scanCopybooksSteps, COPYBOOK_RULES } from '../sets/copybook.mjs';
 import { scanJcl, JCL_RULES } from '../sets/jcl.mjs';
 import { scanBuild, BUILD_RULES } from '../sets/build.mjs';
 import { scanRecon, RECON_RULES } from '../sets/recon.mjs';
 import { scanVendor, VENDOR_RULES } from '../sets/vendor.mjs';
 import { scanOpaque, OPAQUE_RULES } from '../sets/opaque.mjs';
-import { scanWeb, WEB_RULES } from '../sets/web.mjs';
-import { scanPriv, PRIV_RULES } from '../sets/priv.mjs';
-import { scanLog, LOG_RULES } from '../sets/log.mjs';
-import { scanCompile, COMPILE_RULES } from '../sets/compile.mjs';
-import { scanSemantics, SEMANTICS_RULES } from '../sets/semantics.mjs';
+import { scanWeb, scanWebSteps, WEB_RULES } from '../sets/web.mjs';
+import { scanPriv, scanPrivSteps, PRIV_RULES } from '../sets/priv.mjs';
+import { scanLog, scanLogSteps, LOG_RULES } from '../sets/log.mjs';
+import { scanCompile, scanCompileSteps, COMPILE_RULES } from '../sets/compile.mjs';
+import { scanSemantics, scanSemanticsSteps, SEMANTICS_RULES } from '../sets/semantics.mjs';
 import { scanZowe, ZOWE_RULES } from '../sets/zowe.mjs';
 import { scanAbend, ABEND_RULES } from '../sets/abend.mjs';
 import { scanHlasm, HLASM_RULES } from '../sets/hlasm.mjs';
 import { scanCrypto, CRYPTO_RULES } from '../sets/crypto.mjs';
+import { scanSecrets, SECRETS_RULES } from '../sets/secrets.mjs';
 import { toolName } from './ruleset.mjs';
 
 // The order is the order a scan runs them and the order --only lists them. It is not significant
-// to correctness; it is significant to a report being comparable with yesterday's.
+// to correctness; it is significant to a report being comparable with yesterday's. A set with
+// `steps` reads programs through the scan's one shared pass (lib/kernel/shared-pass.mjs).
 export const REGISTRY = [
-  { name: 'flow', scan: scanFlow, rules: FLOW_RULES },
-  { name: 'cics', scan: scanCics, rules: CICS_RULES },
+  { name: 'flow', scan: scanFlow, steps: scanFlowSteps, rules: FLOW_RULES },
+  { name: 'cics', scan: scanCics, steps: scanCicsSteps, rules: CICS_RULES },
   { name: 'hidden', scan: scanHidden, rules: HIDDEN_RULES },
-  { name: 'copybook', scan: scanCopybooks, rules: COPYBOOK_RULES },
+  { name: 'copybook', scan: scanCopybooks, steps: scanCopybooksSteps, rules: COPYBOOK_RULES },
   { name: 'jcl', scan: scanJcl, rules: JCL_RULES },
   { name: 'build', scan: scanBuild, rules: BUILD_RULES },
   { name: 'recon', scan: scanRecon, rules: RECON_RULES },
   { name: 'vendor', scan: scanVendor, rules: VENDOR_RULES },
   { name: 'opaque', scan: scanOpaque, rules: OPAQUE_RULES },
-  { name: 'web', scan: scanWeb, rules: WEB_RULES },
-  { name: 'compile', scan: scanCompile, rules: COMPILE_RULES },
-  { name: 'priv', scan: scanPriv, rules: PRIV_RULES },
-  { name: 'log', scan: scanLog, rules: LOG_RULES },
-  { name: 'semantics', scan: scanSemantics, rules: SEMANTICS_RULES },
+  { name: 'web', scan: scanWeb, steps: scanWebSteps, rules: WEB_RULES },
+  { name: 'compile', scan: scanCompile, steps: scanCompileSteps, rules: COMPILE_RULES },
+  { name: 'priv', scan: scanPriv, steps: scanPrivSteps, rules: PRIV_RULES },
+  { name: 'log', scan: scanLog, steps: scanLogSteps, rules: LOG_RULES },
+  { name: 'semantics', scan: scanSemantics, steps: scanSemanticsSteps, rules: SEMANTICS_RULES },
   { name: 'zowe', scan: scanZowe, rules: ZOWE_RULES },
   { name: 'abend', scan: scanAbend, rules: ABEND_RULES },
   { name: 'hlasm', scan: scanHlasm, rules: HLASM_RULES },
   { name: 'crypto', scan: scanCrypto, rules: CRYPTO_RULES },
+  { name: 'secrets', scan: scanSecrets, rules: SECRETS_RULES },
 ];
 
 // Re-exported from the kernel's ruleset module, which is where it has to live: this file imports

package/lib/kernel/shared-pass.mjs

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// One pass over the tree for every rule set that reads programs, so that a file is read and parsed
+// once per scan rather than once per set.
+//
+// A set's scan is a generator. Where it would run its guarded loop it yields `loopOver(...)` and is
+// resumed with the loop's account, exactly what eachWithinMemory would have returned. `drive` runs
+// one set on its own, its loop as it always ran. `driveTogether` runs several: it gathers the loop
+// each asks for, walks the files of all of them once in the tree's order, gives each set its own
+// files in its own order, and resumes each with its own account. While a file is being handed round,
+// the tree answers text() and parse() for it from what the first set to ask was given.
+//
+// Each set's per-file work is unchanged, so its findings are the ones it reported alone. What is
+// shared is the reading and the parse, which is why no set may change a parse result it is given.
+import { eachWithinMemory, memoryStatus, stoppedBecause, watchMemoryBuffer, MEMORY_RESERVE } from './memory.mjs';
+
+const LOOP = Symbol('loop');
+
+// What a set yields in place of `eachWithinMemory(items, work, opts)`. `guarded: false` asks for a
+// plain loop: every item, no memory check and no byte budget.
+export const loopOver = (items, work, opts = {}) => ({ [LOOP]: true, items, work, opts });
+
+function plainLoop(items, work, label) {
+  for (let i = 0; i < items.length; i++) work(items[i], i);
+  return { label, processed: items.length, bytes: 0, skipped: [], complete: true, stoppedBy: null, peakHeapBytes: 0, note: null };
+}
+
+const runAlone = (req) => (req.opts.guarded === false
+  ? plainLoop(req.items, req.work, req.opts.label || 'scan')
+  : eachWithinMemory(req.items, req.work, req.opts));
+
+export function drive(steps) {
+  let step = steps.next();
+  while (!step.done) step = steps.next(runAlone(step.value));
+  return step.value;
+}
+
+// A tree that, while `focus` names a file, answers text() and parse() for that file once and hands
+// every later caller the same answer, its error included.
+export function sharingTree(base) {
+  let focus = null;
+  let text = null;
+  let parsed = null;
+  const tree = {
+    ...base,
+    focusOn(f) { focus = f; text = null; parsed = null; },
+    text(p) {
+      if (p !== focus) return base.text(p);
+      if (!text) { try { text = { value: base.text(p) }; } catch (e) { text = { error: e }; } }
+      if (text.error) throw text.error;
+      return text.value;
+    },
+    parse(p, src) {
+      if (p !== focus) return base.parse(p, src);
+      const own = src ?? tree.text(p).text;
+      if (!parsed || parsed.src !== own) {
+        try { parsed = { src: own, value: base.parse(p, own) }; } catch (e) { parsed = { src: own, error: e }; }
+      }
+      if (parsed.error) throw parsed.error;
+      return parsed.value;
+    },
+  };
+  return tree;
+}
+
+// Runs every generator to completion and returns their results in the order given. A generator
+// that throws, before its loop or inside it, yields { error } in its place, as a set that throws
+// alone does; the others carry on.
+export function driveTogether(stepsList, tree) {
+  const live = stepsList.map((steps) => ({ steps, step: null, result: undefined, error: null }));
+  const advance = (g, input, thrown) => {
+    try { g.step = thrown ? g.steps.throw(thrown) : g.steps.next(input); } catch (e) { g.error = e; g.step = { done: true }; return; }
+    if (g.step.done) g.result = g.step.value;
+  };
+  for (const g of live) advance(g);
+  for (;;) {
+    const waiting = live.filter((g) => !g.step.done);
+    if (!waiting.length) break;
+    const runs = mergedLoop(waiting.map((g) => g.step.value), tree);
+    waiting.forEach((g, k) => advance(g, runs[k].run, runs[k].error));
+  }
+  return live.map((g) => (g.error ? { error: g.error } : g.result));
+}
+
+// The files of every request, once each, in the order of the tree's list. A request whose items are
+// not in that order runs alone first, so no set sees its files in an order its own loop would not use.
+function mergedLoop(requests, tree) {
+  const rank = new Map(tree.list().map((p, i) => [p, i]));
+  const inOrder = (items) => items.every((p, i) => rank.has(p) && (i === 0 || rank.get(items[i - 1]) < rank.get(p)));
+  const states = requests.map((req) => ({
+    req, guarded: req.opts.guarded !== false, maxBytes: req.opts.maxBytes ?? Infinity, label: req.opts.label || 'scan',
+    next: 0, processed: 0, bytes: 0, skipped: [], stoppedBy: null, error: null, alone: null,
+  }));
+  for (const s of states) if (!inOrder(s.req.items)) {
+    try { s.alone = runAlone(s.req); } catch (e) { s.error = e; s.alone = {}; }
+  }
+  const shared = states.filter((s) => !s.alone);
+  const w = shared.map((s) => s.req.opts.watcher).find(Boolean) || watchMemoryBuffer();
+  const every = Math.min(...shared.map((s) => s.req.opts.every ?? 8), 8);
+  const files = [...new Set(shared.flatMap((s) => s.req.items))].sort((a, b) => rank.get(a) - rank.get(b));
+  let stoppedBy = null;
+  for (let i = 0; i < files.length; i++) {
+    const f = files[i];
+    const wanting = shared.filter((s) => s.req.items[s.next] === f);
+    if (!stoppedBy && wanting.some((s) => s.guarded && !s.error && s.bytes < s.maxBytes)
+      && (i % every === 0 || memoryStatus().fractionUsed > 1 - MEMORY_RESERVE)) {
+      const state = w.check();
+      if ((state === 'exhausted' || state === 'tight') && (!w.collect() || w.stillTight())) {
+        stoppedBy = state === 'exhausted' ? 'memory exhausted' : 'memory reserve';
+      }
+    }
+    tree.focusOn?.(f);
+    for (const s of wanting) {
+      const index = s.next++;
+      if (s.error) continue;
+      if (s.guarded) {
+        if (s.stoppedBy) { s.skipped.push(f); continue; }
+        if (s.bytes >= s.maxBytes) { s.stoppedBy = 'byte budget'; s.skipped.push(f); continue; }
+        if (stoppedBy) { s.stoppedBy = stoppedBy; s.skipped.push(f); continue; }
+      }
+      let took;
+      try { took = s.req.work(f, index); } catch (e) { s.error = e; continue; }
+      if (typeof took === 'number') s.bytes += took;
+      s.processed++;
+    }
+    tree.focusOn?.(null);
+  }
+  return states.map((s) => {
+    if (s.alone) return { run: s.alone, error: s.error };
+    const { items } = s.req;
+    const run = s.guarded
+      ? { label: s.label, processed: s.processed, bytes: s.bytes, skipped: s.skipped, complete: s.skipped.length === 0, stoppedBy: s.stoppedBy, peakHeapBytes: w.peak,
+        note: s.skipped.length === 0 ? null
+          : `${s.label}: ${s.skipped.length} of ${items.length} files were not read because ${stoppedBecause(s.stoppedBy)}. `
+            + 'The findings below are over what was read, and are not a result for this repository as a whole.' }
+      : { label: s.label, processed: s.processed, bytes: 0, skipped: [], complete: true, stoppedBy: null, peakHeapBytes: 0, note: null };
+    return { run, error: s.error };
+  });
+}

package/lib/options.mjs

@@ -485,17 +485,27 @@ export function sourceOperands(args, compiler = 'gnucobol') {
   return out;
 }
 
+// The first GnuCOBOL release with the -fec option, and with each condition added after it.
+const FEC_SINCE = '3.1';
+const CONDITION_SINCE = { 'EC-PROGRAM-ARG-MISMATCH': '3.2' };
+export const olderThan = (version, since) => {
+  const [a, b] = [version, since].map((v) => String(v).split('.').map(Number));
+  for (let i = 0; i < Math.max(a.length, b.length); i++) if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) < (b[i] || 0);
+  return false;
+};
+
 // A cobc argument vector. Returns { checks, forbidden, add }: `add` holds the -fec options that
 // supply a required check nothing turned on, and `forbidden` the options the policy's forbid list
 // names. A check turned off is a failed check, not overridden: appending past it would hide a build
-// configured against the policy.
-export function cobcChecks(args, { required, forbid = [] }) {
+// configured against the policy. With `pinned` ({ version, where }), a check that GnuCOBOL version
+// cannot generate fails, however the command asks for it.
+export function cobcChecks(args, { required, forbid = [], pinned = null }) {
   const state = new Map();
   const turnedOff = new Map();
   const set = (name, on, arg) => {
     for (const check of required) {
       if (!covers(name, EXCEPTION_OF_CHECK[check])) continue;
-      state.set(check, on);
+      state.set(check, on ? arg : false);
       if (on) turnedOff.delete(check); else turnedOff.set(check, arg);
     }
   };
@@ -509,11 +519,23 @@ export function cobcChecks(args, { required, forbid = [] }) {
     if (value === undefined) continue;
     set(exceptionName(value), !m[1], shown);
   }
+  const tooOld = (check, by) => {
+    if (!pinned) return null;
+    const condition = EXCEPTION_OF_CHECK[check];
+    const since = CONDITION_SINCE[condition];
+    const pin = `${pinned.where} pins ${pinned.version}`;
+    if (since && olderThan(pinned.version, since)) return `${check} needs ${condition}, which is in GnuCOBOL ${since} and later; ${pin}`;
+    if (!/^-(debug|d)$/.test(by) && olderThan(pinned.version, FEC_SINCE)) return `${check} needs -fec, which is in GnuCOBOL ${FEC_SINCE} and later; ${pin}`;
+    return null;
+  };
   const add = [];
   const checks = required.map((check) => {
-    if (state.get(check) === true) return { check, ok: true, why: 'turned on by the command line' };
     if (turnedOff.has(check)) return { check, ok: false, why: `${turnedOff.get(check)} turns off the ${check} check` };
     const flag = `-fec=${EXCEPTION_OF_CHECK[check]}`;
+    const by = state.get(check) || flag;
+    const old = tooOld(check, by);
+    if (old) return { check, ok: false, why: old };
+    if (state.get(check)) return { check, ok: true, why: 'turned on by the command line' };
     if (!add.includes(flag)) add.push(flag);
     return { check, ok: true, added: true, why: `added as ${flag}` };
   });

package/lib/policy.mjs

@@ -26,9 +26,13 @@ export const DEFAULT_POLICY = Object.freeze({
   checks: ['subscript', 'reference-modification'],
   forbid: { enterprise: [], gnucobol: [], gcobol: [] },
   requireEquivalence: 'never',
+  interface: 'warn',
 });
 
 export const EQUIVALENCE_MODES = ['never', 'machineAuthored', 'always'];
+// How an abend from a subprogram fuzzed at its interface, with no caller run shown to pass the input,
+// is gated: `warn` never blocks on it, `tier` gates it as any other finding.
+export const INTERFACE_MODES = ['warn', 'tier'];
 
 const KEYS = Object.keys(DEFAULT_POLICY);
 const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -64,6 +68,7 @@ export function validatePolicy(raw) {
     else for (const c of raw.checks) if (!CHECKS.includes(c)) errs.push(`checks: ${printable(c, 40)} is not one of ${CHECKS.join(', ')}`);
   }
   if ('requireEquivalence' in raw && !EQUIVALENCE_MODES.includes(raw.requireEquivalence)) errs.push(`requireEquivalence takes ${EQUIVALENCE_MODES.join(', ')}`);
+  if ('interface' in raw && !INTERFACE_MODES.includes(raw.interface)) errs.push(`interface takes ${INTERFACE_MODES.join(', ')}`);
   if ('forbid' in raw) {
     if (!isObject(raw.forbid)) errs.push(`forbid must be an object keyed by ${COMPILERS.join(', ')}`);
     else for (const [c, list] of Object.entries(raw.forbid)) {
@@ -142,6 +147,7 @@ export function combinePolicies({ floor = null, repository = null } = {}) {
     checks: checks.value,
     forbid: Object.fromEntries(COMPILERS.map((c) => [c, union((f.forbid || {})[c] || [], (r.forbid || {})[c] || [])])),
     requireEquivalence: pick('requireEquivalence', (a, b) => (EQUIVALENCE_MODES.indexOf(a) >= EQUIVALENCE_MODES.indexOf(b) ? a : b)),
+    interface: pick('interface', (a, b) => (a === 'tier' || b === 'tier' ? 'tier' : 'warn')),
     rules: {},
   };
   setBy.checks = checks.by;

package/lib/precompile-cics.mjs

@@ -12,7 +12,7 @@ export const builtinValue = (fn, name) => (fn === 'RESP' ? DFHRESP : DFHVALUE)[n
 const squeeze = (text) => text.replace(/('[^']*'|"[^"]*")|\s+/g, (_, lit) => lit || ' ').trim();
 
 // The options of an EXEC CICS command in order: each word, with its argument's text when it has one.
-function cicsOptions(text) {
+export function cicsOptions(text) {
   const out = [];
   let i = 0;
   while (i < text.length) {

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"2144d560676dda84c8ae6546dfb7b858399f0b7d"}
+{"commit":"67c696c3d6f74d20137372b5f0a756e0b27753dd","tag":"v0.6.0"}

package/lib/sarif.mjs

@@ -213,6 +213,9 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
             ...(f.reach ? { reach: f.reach } : {}),
             ...(f.effect ? { effect: f.effect } : {}),
             ...(f.exploitability ? { exploitability: f.exploitability } : {}),
+            // How an abend's input reached the program: through its own entry, or as arguments to
+            // a subprogram no caller run is shown to pass.
+            ...(f.abend?.inputFrom ? { inputFrom: f.abend.inputFrom } : {}),
           } } : {}),
           locations: [{ physicalLocation: { artifactLocation: { uri: uriOf(f.path), uriBaseId: '%SRCROOT%' }, region: { startLine: f.line || 1 } } }],
           ...(f.related ? { relatedLocations: f.related.map((r) => ({ physicalLocation: { artifactLocation: { uri: uriOf(r.path), uriBaseId: '%SRCROOT%' }, region: { startLine: r.line || 1 } }, message: { text: textOf(r.detail) } })) } : {}),

package/lib/scan.mjs

@@ -3,7 +3,8 @@ import { join, resolve } from 'node:path';
 import { sortFindings, tally, evidenceMap, EVIDENCE, EXPLOITABILITY } from './kernel/findings.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 import { REGISTRY, RULE_SETS, ALL_RULES, reportKey } from './kernel/registry.mjs';
-import { inventory } from './inventory.mjs';
+import { inventorySteps } from './inventory.mjs';
+import { driveTogether, sharingTree } from './kernel/shared-pass.mjs';
 import { stoppedBecause } from './kernel/memory.mjs';
 import { complianceMap, FRAMEWORKS_LOADED, FRAMEWORKS_UNLOADED } from './compliance.mjs';
 import { stampFingerprints, FINGERPRINT_VERSION } from './kernel/identity.mjs';
@@ -178,13 +179,12 @@ export function applyEstateFacts(findings, checked, root, opts = {}) {
 }
 
 // A set that throws is reported as not having run, and the other sets' findings stand.
+const notRun = (set, e) => report(set.name, { rules: set.rules, findings: [], stats: {
+  coverageIncomplete: true,
+  notRead: `the rule set stopped on an error and reported nothing: ${printable(e?.message ?? e)}`,
+} });
 function runSet(set, root, o) {
-  try { return set.scan(root, o); } catch (e) {
-    return report(set.name, { rules: set.rules, findings: [], stats: {
-      coverageIncomplete: true,
-      notRead: `the rule set stopped on an error and reported nothing: ${printable(e?.message ?? e)}`,
-    } });
-  }
+  try { return set.scan(root, o); } catch (e) { return notRun(set, e); }
 }
 
 export function scanAll(root, opts = {}) {
@@ -193,12 +193,22 @@ export function scanAll(root, opts = {}) {
   // One walk of the tree for the whole scan. Every rule set used to call buildFileIndex(root) for
   // itself, so a scan read every directory entry and resolved every symlink nine times over, and
   // added a tenth walk each time a rule set was added.
-  const tree = opts.tree || directoryTree(root, opts);
+  const tree = sharingTree(opts.tree || directoryTree(root, opts));
   const o = { ...opts, tree };
-  const inv = inventory(root, o);
   // One loop over the registry, in its order. A set that is not registered cannot run, and
-  // cannot report a silent zero on its own behalf either.
-  const parts = REGISTRY.filter((set) => only.includes(set.name)).map((set) => runSet(set, root, o));
+  // cannot report a silent zero on its own behalf either. The inventory and the sets that read
+  // programs share one pass, so each program is read and parsed once.
+  const chosen = REGISTRY.filter((set) => only.includes(set.name));
+  const stepped = chosen.filter((set) => set.steps);
+  const [invResult, ...stepResults] = driveTogether([inventorySteps(root, o), ...stepped.map((set) => set.steps(root, o))], tree);
+  if (invResult && invResult.error) throw invResult.error;
+  const inv = invResult;
+  const byName = new Map(stepped.map((set, k) => [set.name, stepResults[k]]));
+  const parts = chosen.map((set) => {
+    if (!byName.has(set.name)) return runSet(set, root, o);
+    const r = byName.get(set.name);
+    return r && r.error ? notRun(set, r.error) : r;
+  });
 
   const flowPart = parts.find(p => p.tool === 'cobolwork-flow');
   const overBudget = flowPart ? flowPart.summary.filesOverBudget || 0 : 0;

package/lib/sets/abend.mjs

@@ -10,6 +10,7 @@ import { createHash } from 'node:crypto';
 import { delimiter, join, posix, basename } from 'node:path';
 import { report } from '../kernel/ruleset.mjs';
 import { verifyEvidence } from '../evidence/verify.mjs';
+import { NOT_RUN_ABENDS } from '../ironwork-ids.mjs';
 
 export const ABEND_RULES = {
   'input-causes-abend-s0c7': {
@@ -30,6 +31,18 @@ export const ABEND_RULES = {
     impact: 'SSRANGE caught the overrun and ended the run; compiled without SSRANGE, as production builds often are, the same input reads or writes storage beside the table or field',
     remedy: 'Check the index against both ends of the table or field before the statement the journal names, and keep SSRANGE on for the build',
   },
+  'input-causes-hang': {
+    sev: 'med', evidence: 'execution', cwe: 'CWE-834',
+    text: 'An input the program accepts keeps a loop running past the statement limit that stands in for its time limit (S322)',
+    impact: 'Whoever supplies that input decides how long the loop runs; on z/OS a long enough run holds the step and its processor until TIME= ends it, and the jobs behind it wait. The run shows the loop passed the limit, not that it would never end',
+    remedy: 'Find the loop at the line the journal names and bound its iterations: check the count or the exit condition the input supplies before the loop starts, or stop it at a counter and reject the input that would pass it',
+  },
+  'input-selects-program': {
+    sev: 'high', evidence: 'execution', cwe: 'CWE-470',
+    text: 'An input the program accepts chooses the program a CALL loads',
+    impact: "Whoever supplies that input picks which load module runs with this program's authority and data; the fuzz run named one the library does not hold, so the run ended in S806, but a name the library does hold runs",
+    remedy: 'Choose the called program from a fixed set of names checked against the input, or call it by a literal name, at the CALL the journal names',
+  },
   'input-causes-abend': {
     sev: 'med', evidence: 'execution', cwe: 'CWE-248',
     text: 'An input the program accepts ends its run with an abend',
@@ -38,6 +51,14 @@ export const ABEND_RULES = {
   },
 };
 
+// What the manifest's `optimized` says of an abend: whether the same input ends the same way with
+// the program compiled at OPTIMIZE(2), where IBM may compare invalid data by its bytes rather than
+// end in a data exception at OPTIMIZE(0), its default.
+const OPTIMIZED = {
+  true: '; compiled with OPTIMIZE(2) it ends the same way',
+  false: '; it holds at OPTIMIZE(0), IBM\'s default: compiled with OPTIMIZE(2) the same input does not end there',
+};
+
 // IBM's messages for an SSRANGE failure: a subscript or index, an OCCURS DEPENDING ON object, and a
 // reference modification's start, length, and start plus length.
 const RANGE_MESSAGES = /^IGZ00(06|07|72|73|74)S\b/;
@@ -47,9 +68,16 @@ export function abendRunPaths(opts = {}) {
   return (process.env.COBOLWORK_ABENDS || '').split(delimiter).filter(Boolean);
 }
 
+// How ironwork ends the message of a data or protection exception in a CICS task, whose abend
+// code CICS reports as ASRA.
+const CICS_PROGRAM_CHECK = /\((S0C7|S0C4), which CICS reports as ASRA\)$/;
+
 export function abendRule(abend) {
-  if (abend.code === 'S0C7') return 'input-causes-abend-s0c7';
-  if (abend.code === 'S0C4') return 'input-causes-abend-s0c4';
+  const code = (abend.code === 'ASRA' && CICS_PROGRAM_CHECK.exec(abend.message || '')?.[1]) || abend.code;
+  if (code === 'S0C7') return 'input-causes-abend-s0c7';
+  if (code === 'S0C4') return 'input-causes-abend-s0c4';
+  if (code === 'S322') return 'input-causes-hang';
+  if (code === 'S806') return 'input-selects-program';
   if (RANGE_MESSAGES.test(abend.message || '')) return 'input-causes-abend-subscript-range';
   return 'input-causes-abend';
 }
@@ -63,16 +91,35 @@ function journalAbend(evidenceDir, runId) {
   let abend = null;
   const inputs = [];
   const calls = [];
+  const sinks = [];
   for (const line of readFileSync(file, 'utf8').split('\n')) {
     if (!line) continue;
     const rec = JSON.parse(line);
     if (rec.kind === 'abend') abend ??= rec;
     else if (rec.kind === 'input') inputs.push(rec);
     else if (rec.kind === 'call') calls.push(rec);
+    else if (rec.kind === 'sink') sinks.push(rec);
   }
-  return abend && { ...abend, inputs, calls };
+  return abend && { ...abend, inputs, calls, sinks };
 }
 
+const MANIFEST_FORMAT = 'ironwork-fuzz/v1';
+// A subprogram fuzzed at its interface: its inputs are arguments, and a caller passing them is
+// not shown to exist (ironwork docs/evidence.md §5.2).
+const INTERFACE_FORMAT = 'ironwork-fuzz-interface/v1';
+const FORMATS = [MANIFEST_FORMAT, INTERFACE_FORMAT];
+
+// What a finding from an interface run says of the caller its input needs.
+function interfaceClause(callers) {
+  const where = callers.length
+    ? `with arguments shaped by the CALL${callers.length === 1 ? '' : 's'} at ${callers.map((c) => `${c.file}:${c.line}`).join(', ')}`
+    : 'on generated arguments, with no CALL to it in the scanned tree';
+  return `; it ran as a subprogram, ${where}, on its first call in its initial state: a caller passing these bytes ends it, and no caller run shows one does`;
+}
+
+// ironwork's own abend codes for a construct it does not run: no IBM system would raise them.
+const NOT_MODELLED = new Set(NOT_RUN_ABENDS);
+
 const isString = (x) => typeof x === 'string' && x.length > 0;
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
@@ -113,6 +160,15 @@ export function loadAbendRun(dir, tree) {
     out.problems.push('manifest.json is not an ironwork-fuzz manifest with a program, inputs and runs');
     return out;
   }
+  // A manifest from before ironwork wrote `format` has the first format's shape.
+  if (doc.format !== undefined && !FORMATS.includes(doc.format)) {
+    out.problems.push(`manifest.json is in format ${JSON.stringify(doc.format)}, and this cobolwork reads ${FORMATS.join(' and ')}`);
+    return out;
+  }
+  const inputFrom = doc.format === INTERFACE_FORMAT ? 'interface' : 'entry';
+  const callers = inputFrom === 'interface' && Array.isArray(doc.callers)
+    ? doc.callers.filter((c) => c && isString(c.file) && Number.isInteger(c.line)).map((c) => ({ file: posix.normalize(c.file.replace(/\\/g, '/')), line: c.line }))
+    : [];
   const programFile = posix.normalize(doc.program.file.replace(/\\/g, '/'));
   if (programFile.startsWith('../') || posix.isAbsolute(programFile)) {
     out.problems.push(`the program ${doc.program.file} is outside the scanned tree`);
@@ -131,7 +187,7 @@ export function loadAbendRun(dir, tree) {
   const seen = new Map();
   for (const run of doc.runs) {
     if (!run || run.outcome !== 'abend' || !run.abend || !isString(run.abend.code)) continue;
-    if (run.abend.code === 'IRONWORK') { out.notModelled++; continue; }
+    if (NOT_MODELLED.has(run.abend.code)) { out.notModelled++; continue; }
     const recorded = journalAbend(evidenceDir, run.journal);
     if (!recorded || recorded.code !== run.abend.code) {
       out.problems.push(`run ${run.journal ?? '(unnamed)'}: its journal does not record the abend ${run.abend.code} the manifest gives`);
@@ -152,16 +208,23 @@ export function loadAbendRun(dir, tree) {
     const where = isString(place.file) ? posix.normalize(posix.join(rootDir ?? posix.dirname(programFile), place.file.replace(/\\/g, '/'))) : programFile;
     const line = Number.isInteger(place.line) && place.line > 0 ? place.line : 1;
     const rule = abendRule(run.abend);
+    // An S806 is input choosing the program only where the run's own journal records the marker
+    // fuzz put in the input reaching that CALL's program load.
+    if (rule === 'input-selects-program' && !recorded.sinks.some((k) => k.sink === 'dynamic-program-load' && k.reached === true && k.file === place.file && k.line === place.line)) {
+      out.problems.push(`run ${run.journal}: its journal does not record the input reaching the CALL at ${place.file}:${place.line}, so its S806 is not reported`);
+      continue;
+    }
     const used = (Array.isArray(run.input) ? run.input : []).map((id) => inputs.get(id)).filter(Boolean)
-      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}) }));
+      .map((i) => ({ kind: i.kind, name: i.name, bytes: i.bytes, ...(i.minimized ? { minimized: true } : {}), ...(Number.isInteger(i.position) ? { position: i.position } : {}), ...(i.omitted === true ? { omitted: true } : {}) }));
     const key = `${rule}|${where}|${line}`;
     const size = used.reduce((n, i) => n + String(i.bytes || '').length, 0);
     const held = seen.get(key);
     if (held && held.size <= size) continue;
+    const optimized = typeof run.abend.optimized === 'boolean' ? run.abend.optimized : undefined;
     const finding = {
       rule, path: where, line, program: out.program.id,
-      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept`,
-      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}) },
+      detail: `${out.program.id || programFile} ended with ${run.abend.code}${isString(run.abend.message) ? ` (${run.abend.message})` : ''} on an input the fuzz run ${out.dir} kept${OPTIMIZED[optimized] ?? ''}${inputFrom === 'interface' ? interfaceClause(callers) : ''}`,
+      abend: { code: run.abend.code, ...(isString(run.abend.message) ? { message: run.abend.message } : {}), ...(optimized === undefined ? {} : { optimized }), inputFrom, ...(inputFrom === 'interface' ? { callers } : {}) },
       input: used, run: { dir: out.dir, journal: run.journal },
     };
     seen.set(key, { size, finding });
@@ -179,6 +242,7 @@ export function scanAbend(root, opts = {}) {
     abendRuns: runs.map((r) => ({ dir: r.dir, program: r.program ? r.program.file : null, findings: r.findings.length, ...(r.notModelled ? { notModelled: r.notModelled } : {}), ...(r.counts ? { counts: r.counts } : {}) })),
     ...(runs.some((r) => r.problems.length) ? { abendRunProblems: runs.flatMap((r) => r.problems.map((p) => `${r.dir}: ${p}`)) } : {}),
     ...(runs.some((r) => r.findings.some((f) => !existsSync(join(root, f.path)))) ? { abendRunsElsewhere: runs.flatMap((r) => r.findings.filter((f) => !existsSync(join(root, f.path))).map((f) => `${r.dir}: ${f.path}`)) } : {}),
+    byInputFrom: { entry: findings.filter((f) => f.abend.inputFrom === 'entry').length, interface: findings.filter((f) => f.abend.inputFrom === 'interface').length },
     setIncomplete: runs.some((r) => r.problems.length > 0),
   };
   return report('abend', { rules: ABEND_RULES, findings, stats, run: null });

package/lib/sets/build.mjs

@@ -55,7 +55,7 @@ const COMPILERS = new Set(['gnucobol', 'opentext-cobol', 'ibm-enterprise-cobol']
 
 // Files that decide what the build runs. A repository states this in one of a small number of
 // conventional places, and reading only those keeps the rule from matching prose in a README.
-function isBuildFile(path) {
+export function isBuildFile(path) {
   const name = basename(path);
   const p = path.replace(/\\/g, '/').toLowerCase();
   if (/^(dockerfile|containerfile)(\..+)?$/i.test(name)) return true;
@@ -98,6 +98,21 @@ const PINS = [
   { product: 'cics-transaction-gateway', re: /from\s+\S*cics[-_]?transaction[-_]?gateway\S*:v?(\d+(?:\.\d+)+)/gi },
 ];
 
+// Every product version the text pins, once each, with the text that pins it.
+export function pinsIn(src) {
+  const out = [];
+  const seen = new Set();
+  for (const { product, re } of PINS) {
+    for (const m of src.matchAll(re)) {
+      const key = `${product}@${m[1]}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ product, version: m[1], text: m[0] });
+    }
+  }
+  return out;
+}
+
 function withMavenProperties(src) {
   const block = src.match(/<properties>([\s\S]*?)<\/properties>/i);
   if (!block) return src;
@@ -189,42 +204,33 @@ export function scanBuild(root, opts = {}) {
     if (/pom\.xml$/i.test(path)) src = withMavenProperties(src);
     const lines = src.split(/\r?\n/);
 
-    const seen = new Set();
-    for (const { product, re } of PINS) {
-      re.lastIndex = 0;
-      let m;
-      while ((m = re.exec(src)) !== null) {
-        const version = m[1];
-        const key = product + '@' + version;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        stats.pinsFound++;
-
-        const hits = advisoriesFor(product, version, extra);
-        if (!hits.length) continue;
-
-        // A pin written across lines, as Maven writes one, is reported at its version.
-        const needle = m[0].includes('\n') ? m[0].split('\n').pop().trim() : m[0];
-        const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
-        const exploited = hits.filter((a) => isKnownExploited(a.id));
-        const ids = hits.map((a) => a.id).sort(byText);
-
-        const kind = COMPILERS.has(product) ? 'compiler' : 'component';
-        if (exploited.length) {
-          findings.push({
-            rule: `build-pins-exploited-${kind}`, path, line,
-            detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
-            related: hits.map(relatedOf),
-            knownExploited: exploited.map((a) => a.id).sort(byText),
-          });
-        } else {
-          findings.push({
-            rule: `build-pins-vulnerable-${kind}`, path, line,
-            detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
-              (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
-            related: hits.map(relatedOf),
-          });
-        }
+    for (const { product, version, text } of pinsIn(src)) {
+      stats.pinsFound++;
+
+      const hits = advisoriesFor(product, version, extra);
+      if (!hits.length) continue;
+
+      // A pin written across lines, as Maven writes one, is reported at its version.
+      const needle = text.includes('\n') ? text.split('\n').pop().trim() : text;
+      const line = lines.findIndex((l) => l.includes(needle)) + 1 || 1;
+      const exploited = hits.filter((a) => isKnownExploited(a.id));
+      const ids = hits.map((a) => a.id).sort(byText);
+
+      const kind = COMPILERS.has(product) ? 'compiler' : 'component';
+      if (exploited.length) {
+        findings.push({
+          rule: `build-pins-exploited-${kind}`, path, line,
+          detail: `${path} pins ${product} ${version}, which ${exploited.map((a) => a.id).sort(byText).join(', ')} affects and CISA lists as known to be exploited${fromFeeds(hits)}`,
+          related: hits.map(relatedOf),
+          knownExploited: exploited.map((a) => a.id).sort(byText),
+        });
+      } else {
+        findings.push({
+          rule: `build-pins-vulnerable-${kind}`, path, line,
+          detail: `${path} pins ${product} ${version}, which ${countOf(hits)}: ${ids.join(', ')}${fromFeeds(hits)}` +
+            (age.stale ? `. The KEV snapshot is ${age.days} days old, so whether any of these is now known to be exploited was not checked against a current catalogue` : ''),
+          related: hits.map(relatedOf),
+        });
       }
     }
     return src.length;