@portll/cobolwork 0.5.0 → 0.7.0

package/lib/sets/compile.mjs

@@ -13,7 +13,7 @@ import { basename, extname } from 'node:path';
 import { inScope, isProgram, relPath, readSource } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 
 // construct: no input has to reach it. med: certain once every copybook is found, and it means the
 // tree does not hold what runs, but it is not exploitable in itself. CWE-1127: MITRE discourages
@@ -59,11 +59,13 @@ const REPLACE_STATEMENT = /\bREPLACE\b([\s\S]*?)(?:\.\s|\.$)/gim;
 
 // A header declares a paragraph only where the sentence before it has ended: after a line of code
 // ending in a period, or with no code before it. Without the period the name is read as part of the
-// statement before, and the compiler reports it undefined.
-function sentenceEndsBefore(text, at) {
-  const lines = text.slice(0, at).split(/\r?\n/);
-  lines.pop();
-  for (let i = lines.length - 1; i >= 0; i--) {
+// statement before, and the compiler reports it undefined. `lines` and `starts` are the text's lines
+// and where each begins.
+function sentenceEndsBefore(lines, starts, at) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) { const mid = (lo + hi + 1) >>> 1; if (starts[mid] <= at) lo = mid; else hi = mid - 1; }
+  for (let i = lo - 1; i >= 0; i--) {
     const l = lines[i];
     if (/^.{6}[*/]/.test(l) || /^\s*\*>/.test(l)) continue;
     const code = l.slice(0, 72).replace(/\*>.*$/, '').replace(/^[0-9 ]{6}(?=[ \-D])/, '').trim();
@@ -72,12 +74,17 @@ function sentenceEndsBefore(text, at) {
   return true;
 }
 
-function declaredIn(text, names, into) {
-  const note = (w) => { const u = w.toUpperCase(); if (names.has(u)) into.add(u); };
+// Every name a text declares, upper-cased, whatever is being looked for.
+function declaredWords(text) {
+  const words = new Set();
+  const note = (w) => words.add(w.toUpperCase());
+  const lines = text.split(/\r?\n/);
+  const starts = [0];
+  for (const m of text.matchAll(/\r?\n/g)) starts.push(m.index + m[0].length);
   for (const re of [DECLARATION, HEADER]) {
     re.lastIndex = 0;
     let m;
-    while ((m = re.exec(text))) if (re !== HEADER || sentenceEndsBefore(text, m.index)) note(m[1]);
+    while ((m = re.exec(text))) if (re !== HEADER || sentenceEndsBefore(lines, starts, m.index)) note(m[1]);
   }
   for (const re of [COPY_STATEMENT, REPLACE_STATEMENT]) {
     re.lastIndex = 0;
@@ -87,9 +94,11 @@ function declaredIn(text, names, into) {
       for (const w of m[1].match(/[A-Za-z0-9][A-Za-z0-9-]*/g) || []) note(w);
     }
   }
-  return into;
+  return words;
 }
 
+const declaredIn = (words, names, into) => { for (const u of names) if (words.has(u)) into.add(u); return into; };
+
 // A reference cut at column 72 names a word the source does not hold.
 function truncated(ref, lines) {
   const line = (lines.get(ref.file) || [])[ref.line - 1] || '';
@@ -102,7 +111,7 @@ function truncated(ref, lines) {
   return any && !whole;
 }
 
-export function scanCompile(root, opts = {}) {
+export function* scanCompileSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isProgram).filter(inScope(opts));
   const findings = [];
@@ -114,10 +123,26 @@ export function scanCompile(root, opts = {}) {
     because[why] = (because[why] || 0) + 1;
     undecided.push(`${tree.rel(f)} (${id}): ${why}: ${[...new Set(refs.map((x) => x.name))].slice(0, SHOWN).join(', ')}`);
   };
-  const textOf = (p) => (tree.contains(p) ? tree.text(p) : readSource(p)).text;
+  // A copybook's text, lines and declared names, read once for every program that copies it.
+  const remembered = (read) => {
+    const held = new Map();
+    return (p) => {
+      let h = held.get(p);
+      if (!h) {
+        try { const text = read(p); h = { text, lines: null, words: null }; } catch (e) { h = { error: e }; }
+        held.set(p, h);
+      }
+      if (h.error) throw h.error;
+      return h;
+    };
+  };
+  const copyOf = remembered((p) => (tree.contains(p) ? tree.text(p) : readSource(p)).text);
+  const answerOf = remembered((p) => tree.text(p).text);
+  const wordsOf = (h) => (h.words ||= declaredWords(h.text));
+  const linesOf = (h) => (h.lines ||= h.text.split(/\r?\n/));
   const candidates = [];
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     if (LISTING.test(src)) { stats.filesScanned++; stats.listingsSkipped = (stats.listingsSkipped || 0) + 1; return src.length; }
@@ -126,6 +151,7 @@ export function scanCompile(root, opts = {}) {
     stats.filesScanned++;
     const blocked = whyUndecided(r, src);
     const copied = [...new Set(r.copies.filter((c) => c.path).map((c) => c.path))];
+    const own = { text: src, lines: null, words: null };
     for (const p of r.programs) {
       // A class or a method has no PROGRAM-ID, and the data its methods use belongs to no program here.
       if (!p.id || p.diags.some((d) => d.kind === 'no-procedure-division')) continue;
@@ -133,11 +159,11 @@ export function scanCompile(root, opts = {}) {
       if (!p.unresolvedRefs.length) continue;
       if (blocked) { undecide(f, p.id, blocked, p.unresolvedRefs); continue; }
       const names = new Set(p.unresolvedRefs.map((x) => x.name));
-      const texts = new Map([[f, src]]);
-      for (const q of copied) { try { texts.set(q, textOf(q)); } catch { /* the parse read it once; a second failure changes nothing */ } }
+      const texts = new Map([[f, own]]);
+      for (const q of copied) { try { texts.set(q, copyOf(q)); } catch { /* the parse read it once; a second failure changes nothing */ } }
       const seen = new Set();
-      for (const text of texts.values()) declaredIn(text, names, seen);
-      const lines = new Map([...texts].map(([q, t]) => [q, t.split(/\r?\n/)]));
+      for (const h of texts.values()) declaredIn(wordsOf(h), names, seen);
+      const lines = new Map([...texts].map(([q, h]) => [q, linesOf(h)]));
       const left = p.unresolvedRefs.filter((x) => !seen.has(x.name) && !truncated(x, lines));
       if (!left.length) { undecide(f, p.id, 'the parse missed a declaration the text holds', p.unresolvedRefs); continue; }
       candidates.push({ file: f, id: p.id, line: p.line, refs: left, copied: new Set(r.copies.map((c) => nameOf(c.name))) });
@@ -160,7 +186,7 @@ export function scanCompile(root, opts = {}) {
   for (const c of candidates) {
     const names = new Set(c.refs.map((x) => x.name));
     const seen = new Set();
-    for (const n of c.copied) for (const p of answering.get(n) || []) { try { declaredIn(tree.text(p).text, names, seen); } catch { /* unread declares nothing */ } }
+    for (const n of c.copied) for (const p of answering.get(n) || []) { try { declaredIn(wordsOf(answerOf(p)), names, seen); } catch { /* unread declares nothing */ } }
     const left = c.refs.filter((x) => !seen.has(x.name));
     if (!left.length) { undecide(c.file, c.id, 'another copybook of a name it copies declares them', c.refs); continue; }
     const firsts = new Map();
@@ -186,3 +212,5 @@ export function scanCompile(root, opts = {}) {
   if (stats.filesUnparsed) stats.coverageIncomplete = true;
   return report('compile', { rules: COMPILE_RULES, findings, stats, run });
 }
+
+export const scanCompile = (root, opts = {}) => drive(scanCompileSteps(root, opts));

package/lib/sets/copybook.mjs

@@ -6,7 +6,7 @@ import { inScope, isCopybook, isProgram, relPath } from '../sources.mjs';
 import { finish } from '../kernel/findings.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { cobolCard } from '../cards.mjs';
 
 // A copybook is resolved by name along a search path: the program's own directory first, then the
@@ -71,7 +71,7 @@ export function systemLayoutDeparture(name, text) {
   return null;
 }
 
-export function scanCopybooks(root, opts = {}) {
+export function* scanCopybooksSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const all = tree.list().filter(inScope(opts));
   const findings = [];
@@ -100,7 +100,7 @@ export function scanCopybooks(root, opts = {}) {
   // is what stops the reading before the heap does.
   let run = { skipped: [], stoppedBy: null, peakHeapBytes: 0, note: null };
   if (candidates.size) {
-    run = eachWithinMemory(all.filter(isProgram), (p) => {
+    run = yield loopOver(all.filter(isProgram), (p) => {
       let src;
       try { src = tree.text(p).text; } catch (e) { noteUnread(stats, tree, p, e); return 0; }
       let r;
@@ -173,3 +173,5 @@ export function scanCopybooks(root, opts = {}) {
   // that looks unshadowed may only look that way.
   return report('copybook', { rules: COPYBOOK_RULES, findings, stats, run });
 }
+
+export const scanCopybooks = (root, opts = {}) => drive(scanCopybooksSteps(root, opts));

package/lib/sets/crypto.mjs

@@ -11,7 +11,7 @@ import { readFileSync } from 'node:fs';
 import { inScope, isProgram, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 import { constantsReaching, keywordsOf } from '../constants.mjs';
 
 const TABLE = JSON.parse(readFileSync(new URL('../../rules/icsf-services.json', import.meta.url), 'utf8'));
@@ -54,13 +54,13 @@ const argument = (call, service, parameter) => {
 };
 const shown = (values) => [...new Set(values.map((v) => (/^[A-Z-]+$/.test(v) ? v : `'${v.trim()}'`)))].join(', ');
 
-export function scanCrypto(root, opts = {}) {
+export function* scanCryptoSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isProgram).filter(inScope(opts));
   const findings = [];
   const stats = { filesScanned: 0, filesUnreadable: 0, filesUnparsed: 0, icsfCalls: 0, argumentsUndecided: 0 };
 
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let src;
     try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     if (!/CALL\s+['"]?CS[NF]/i.test(src)) return src.length;
@@ -108,3 +108,5 @@ export function scanCrypto(root, opts = {}) {
 
   return report('crypto', { rules: CRYPTO_RULES, findings, stats, run });
 }
+
+export const scanCrypto = (root, opts = {}) => drive(scanCryptoSteps(root, opts));

package/lib/sets/ddl.mjs

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Db2 for z/OS DDL: what a GRANT opens to PUBLIC or lets a grantee pass on, system and database
+// authorities granted, and the exit routines and external load modules that run inside Db2
+// (lib/db2/rules.mjs). A statement in another dialect is refused by the reader and counted as not
+// read, never matched as if it were Db2.
+import { inScope, isDb2, relPath } from '../sources.mjs';
+import { report } from '../kernel/ruleset.mjs';
+import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
+import { eachWithinMemory } from '../kernel/memory.mjs';
+import { readDb2, parseDb2Statement } from '../db2/read.mjs';
+import { DB2_RULES, statementFindings } from '../db2/rules.mjs';
+
+export { DB2_RULES };
+
+export function scanDb2(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const files = tree.list().filter(inScope(opts)).filter(isDb2);
+  const stats = { filesScanned: 0, filesUnreadable: 0, statementsRead: 0 };
+  const findings = [];
+  const unread = {};
+  const run = eachWithinMemory(files, (f) => {
+    let src;
+    try { src = tree.text(f).text; } catch (e) { noteUnread(stats, tree, f, e); return 0; }
+    stats.filesScanned++;
+    const path = relPath(root, f);
+    for (const st of readDb2(src).statements) {
+      const r = parseDb2Statement(st);
+      if (r.status === 'parsed') { stats.statementsRead++; findings.push(...statementFindings(path, st, r)); }
+      else (unread[r.kind] ||= { count: 0, first: `${path}:${st.line}` }).count++;
+    }
+    return src.length;
+  }, { label: 'ddl', maxBytes: opts.maxSourceBytes ?? Infinity });
+
+  if (Object.keys(unread).length) { stats.statementsNotRead = unread; stats.coverageIncomplete = true; }
+  return report('ddl', { rules: DB2_RULES, findings, stats, run });
+}

package/lib/sets/flow.mjs

@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { analyze } from '../dataflow.mjs';
+import { resolve } from 'node:path';
+import { directoryTree } from '../kernel/source-tree.mjs';
+import { analyzeSteps } from '../dataflow.mjs';
+import { drive } from '../kernel/shared-pass.mjs';
 import { FLOW_MODEL, SCHEMA_VERSION, TOOL_VERSION } from '../version.mjs';
 import { finish, withMeta, sortFindings } from '../kernel/findings.mjs';
 
@@ -11,21 +14,25 @@ export const RULES = {
   'cics-terminal-to-os-command': { sev: 'crit', evidence: 'path', cwe: 'CWE-78', text: 'Terminal input reaches an operating-system command routine' },
   'cics-web-to-os-command': { sev: 'crit', evidence: 'path', cwe: 'CWE-78', text: 'Web input reaches an operating-system command routine' },
   'file-record-to-os-command': { sev: 'high', evidence: 'path', cwe: 'CWE-78', text: 'A file record reaches an operating-system command routine' },
+  'cics-queue-to-os-command': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-78', text: 'A CICS queue item reaches an operating-system command routine' },
   'database-to-os-command': { sev: 'high', evidence: 'path', cwe: 'CWE-78', text: 'A database value reaches an operating-system command routine' },
   'argv-or-env-to-dynamic-sql': { sev: 'high', evidence: 'path', cwe: 'CWE-89', text: 'Command-line or environment input reaches dynamic SQL' },
   'cics-terminal-to-dynamic-sql': { sev: 'crit', evidence: 'path', cwe: 'CWE-89', text: 'Terminal input reaches dynamic SQL' },
   'cics-web-to-dynamic-sql': { sev: 'crit', evidence: 'path', cwe: 'CWE-89', text: 'Web input reaches dynamic SQL' },
   'file-record-to-dynamic-sql': { sev: 'high', evidence: 'path', cwe: 'CWE-89', text: 'A file record reaches dynamic SQL' },
+  'cics-queue-to-dynamic-sql': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-89', text: 'A CICS queue item reaches dynamic SQL' },
   'database-to-dynamic-sql': { sev: 'high', evidence: 'path', cwe: 'CWE-89', text: 'A database value reaches dynamic SQL' },
   'argv-or-env-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'Command-line or environment input decides which program CICS transfers to' },
   'cics-terminal-to-cics-dynamic-transfer': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Terminal input decides which program CICS transfers to' },
   'cics-web-to-cics-dynamic-transfer': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Web input decides which program CICS transfers to' },
   'file-record-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A file record decides which program CICS transfers to' },
+  'cics-queue-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-470', text: 'A CICS queue item decides which program CICS transfers to' },
   'database-to-cics-dynamic-transfer': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A database value decides which program CICS transfers to' },
   'argv-or-env-to-dynamic-program-load': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'Command-line or environment input decides which program is called' },
   'cics-terminal-to-dynamic-program-load': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Terminal input decides which program is called' },
   'cics-web-to-dynamic-program-load': { sev: 'crit', evidence: 'path', cwe: 'CWE-470', text: 'Web input decides which program is called' },
   'file-record-to-dynamic-program-load': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A file record decides which program is called' },
+  'cics-queue-to-dynamic-program-load': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-470', text: 'A CICS queue item decides which program is called' },
   'database-to-dynamic-program-load': { sev: 'high', evidence: 'path', cwe: 'CWE-470', text: 'A database value decides which program is called' },
   // A program opening the file its own user named acts with that user's authority, which is every
   // one read in the 500-repository corpus; it escalates only where the estate says the entry that
@@ -34,6 +41,7 @@ export const RULES = {
   'cics-terminal-to-dynamic-file-path': { sev: 'high', evidence: 'path', cwe: 'CWE-73', text: 'Terminal input decides which file is opened' },
   'cics-web-to-dynamic-file-path': { sev: 'high', evidence: 'path', cwe: 'CWE-73', text: 'Web input decides which file is opened' },
   'file-record-to-dynamic-file-path': { sev: 'med', evidence: 'path', cwe: 'CWE-73', text: 'A file record decides which file is opened' },
+  'cics-queue-to-dynamic-file-path': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-73', text: 'A CICS queue item decides which file is opened' },
   'database-to-dynamic-file-path': { sev: 'med', evidence: 'path', cwe: 'CWE-73', text: 'A database value decides which file is opened' },
   // A JCL step is the entry point above the program. PARM is the mainframe's argv, and in-stream
   // data is a payload sitting in the repository: both are edited by anyone who can commit, so they
@@ -57,6 +65,7 @@ export const RULES = {
   'cics-terminal-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'Terminal input is written into a job the internal reader submits' },
   'cics-web-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'Web input is written into a job the internal reader submits' },
   'file-record-to-internal-reader': { sev: 'med', evidence: 'path', cwe: 'CWE-77', text: 'A file record is written into a job the internal reader submits' },
+  'cics-queue-to-internal-reader': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-77', text: 'A CICS queue item is written into a job the internal reader submits' },
   'database-to-internal-reader': { sev: 'med', evidence: 'path', cwe: 'CWE-77', text: 'A database value is written into a job the internal reader submits' },
   'jcl-parm-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'A JCL PARM is written into a job the internal reader submits' },
   'jcl-instream-to-internal-reader': { sev: 'crit', evidence: 'path', cwe: 'CWE-77', text: 'In-stream job data is written into a job the internal reader submits' },
@@ -65,18 +74,22 @@ export const RULES = {
   'cics-web-to-web-response': { sev: 'high', evidence: 'path', cwe: 'CWE-79', text: 'Web input is written into the response this program returns' },
   'cics-terminal-to-web-response': { sev: 'high', evidence: 'path', cwe: 'CWE-79', text: 'Terminal input is written into the response this program returns' },
   'file-record-to-web-response': { sev: 'med', evidence: 'path', cwe: 'CWE-79', text: 'A file record is written into the response this program returns' },
+  'cics-queue-to-web-response': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-79', text: 'A CICS queue item is written into the response this program returns' },
   'database-to-web-response': { sev: 'med', evidence: 'path', cwe: 'CWE-79', text: 'A database value is written into the response this program returns' },
   'cics-web-to-http-header': { sev: 'high', evidence: 'path', cwe: 'CWE-113', text: 'Web input is written into a header of the response' },
   'cics-terminal-to-http-header': { sev: 'high', evidence: 'path', cwe: 'CWE-113', text: 'Terminal input is written into a header of the response' },
   'file-record-to-http-header': { sev: 'med', evidence: 'path', cwe: 'CWE-113', text: 'A file record is written into a header of the response' },
+  'cics-queue-to-http-header': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-113', text: 'A CICS queue item is written into a header of the response' },
   'database-to-http-header': { sev: 'med', evidence: 'path', cwe: 'CWE-113', text: 'A database value is written into a header of the response' },
   'cics-web-to-outbound-host': { sev: 'high', evidence: 'path', cwe: 'CWE-918', text: 'Web input decides the host or path this program sends a request to' },
   'cics-terminal-to-outbound-host': { sev: 'high', evidence: 'path', cwe: 'CWE-918', text: 'Terminal input decides the host or path this program sends a request to' },
   'file-record-to-outbound-host': { sev: 'med', evidence: 'path', cwe: 'CWE-918', text: 'A file record decides the host or path this program sends a request to' },
+  'cics-queue-to-outbound-host': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-918', text: 'A CICS queue item decides the host or path this program sends a request to' },
   'database-to-outbound-host': { sev: 'med', evidence: 'path', cwe: 'CWE-918', text: 'A database value decides the host or path this program sends a request to' },
   'cics-web-to-queue-name': { sev: 'high', evidence: 'path', cwe: 'CWE-99', text: 'Web input names the queue a command reads, writes or deletes' },
   'cics-terminal-to-queue-name': { sev: 'high', evidence: 'path', cwe: 'CWE-99', text: 'Terminal input names the queue a command reads, writes or deletes' },
   'file-record-to-queue-name': { sev: 'med', evidence: 'path', cwe: 'CWE-99', text: 'A file record names the queue a command reads, writes or deletes' },
+  'cics-queue-to-queue-name': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-99', text: 'A CICS queue item names the queue a command reads, writes or deletes' },
   'database-to-queue-name': { sev: 'med', evidence: 'path', cwe: 'CWE-99', text: 'A database value names the queue a command reads, writes or deletes' },
   // Where a statement reads or writes, decided by input from outside. Without SSRANGE, which is not
   // the Enterprise COBOL default, an index out of range reads or writes the storage beside the
@@ -130,10 +143,12 @@ export const RULES = {
   'cics-terminal-to-cics-sysid': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'Terminal input decides which region a CICS command is shipped to' },
   'cics-web-to-cics-sysid': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'Web input decides which region a CICS command is shipped to' },
   'file-record-to-cics-sysid': { sev: 'low', evidence: 'path', cwe: 'CWE-15', text: 'A file record decides which region a CICS command is shipped to' },
+  'cics-queue-to-cics-sysid': { sev: 'low', evidence: 'path', measured: false, cwe: 'CWE-15', text: 'A CICS queue item decides which region a CICS command is shipped to' },
   'database-to-cics-sysid': { sev: 'low', evidence: 'path', cwe: 'CWE-15', text: 'A database value decides which region a CICS command is shipped to' },
   'cics-terminal-to-cics-system-resource': { sev: 'high', evidence: 'path', cwe: 'CWE-15', text: 'Terminal input names the resource an EXEC CICS SET changes' },
   'cics-web-to-cics-system-resource': { sev: 'high', evidence: 'path', cwe: 'CWE-15', text: 'Web input names the resource an EXEC CICS SET changes' },
   'file-record-to-cics-system-resource': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'A file record names the resource an EXEC CICS SET changes' },
+  'cics-queue-to-cics-system-resource': { sev: 'med', evidence: 'path', measured: false, cwe: 'CWE-15', text: 'A CICS queue item names the resource an EXEC CICS SET changes' },
   'database-to-cics-system-resource': { sev: 'med', evidence: 'path', cwe: 'CWE-15', text: 'A database value names the resource an EXEC CICS SET changes' },
   // A document from outside parsed as XML. Whether a DTD in it is honoured - an external entity
   // fetched, an internal one expanded - is the parser's, chosen by the XMLPARSE compiler option, and
@@ -165,12 +180,16 @@ export const RULES = {
   // way mainframe systems hand data to each other and is listed so the route is visible.
   'database-to-outbound-http': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A database value is sent to a remote server over HTTP' },
   'file-record-to-outbound-http': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A file record is sent to a remote server over HTTP' },
+  'cics-queue-to-outbound-http': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is sent to a remote server over HTTP' },
   'database-to-socket-send': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A database value is written to a network socket' },
   'file-record-to-socket-send': { sev: 'high', evidence: 'path', cwe: 'CWE-201', text: 'A file record is written to a network socket' },
+  'cics-queue-to-socket-send': { sev: 'high', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is written to a network socket' },
   'database-to-message-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A database value is put on a message queue' },
   'database-to-extrapartition-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A database value is written to a transient-data queue that leaves the region' },
   'file-record-to-extrapartition-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A file record is written to a transient-data queue that leaves the region' },
+  'cics-queue-to-extrapartition-queue': { sev: 'low', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is written to a transient-data queue that leaves the region' },
   'file-record-to-message-queue': { sev: 'low', evidence: 'path', cwe: 'CWE-201', text: 'A file record is put on a message queue' },
+  'cics-queue-to-message-queue': { sev: 'low', evidence: 'path', measured: false, cwe: 'CWE-201', text: 'A CICS queue item is put on a message queue' },
   // The CALL interface itself, from the same bound pairs the paths above cross. No input has to
   // reach these: a callee that declares more than it is passed reaches past it on every call.
   'call-parameter-exceeds-caller-record': { sev: 'high', evidence: 'construct', cwe: 'CWE-805', text: 'A called program declares a parameter longer than the whole record its caller passes' },
@@ -190,6 +209,7 @@ export const WHO = {
   'cics-terminal': 'A terminal user',
   'cics-web': 'A web caller',
   'file-record': 'Whoever can write the file record',
+  'cics-queue': 'Whoever can write the queue, or start the transaction with data',
   'database': 'Whoever can write the database row',
   'jcl-parm': "Whoever can edit the job's PARM",
   'jcl-instream': "Whoever can edit the job's in-stream data",
@@ -216,7 +236,7 @@ const SINK = {
   },
   'dynamic-file-path': {
     clause: 'chooses which dataset the program opens',
-    remedy: 'Map input to a fixed set of DDs or dataset names; do not build the ASSIGN or dynamic-allocation name from input',
+    remedy: 'Map input to a fixed set of DDs, dataset names or CICS file names; do not build the ASSIGN, dynamic-allocation or FILE name from input',
   },
   'internal-reader': {
     clause: "submits an arbitrary job, for a CICS program under the region's authority",
@@ -365,11 +385,11 @@ function mergeRoutes(a, b) {
   };
 }
 // One graph per repository, for the reason scanAll gives: names are only unique within one.
-function analyzeEach(root, opts) {
-  if (!opts.repos || opts.repos.length < 2) return analyze(root, opts);
+function* analyzeEach(root, opts) {
+  if (!opts.repos || opts.repos.length < 2) return yield* analyzeSteps(root, opts);
   const merged = { findings: [], constructs: [], unstarted: [], startedBy: {}, stats: {} };
   for (const repo of opts.repos) {
-    const one = analyze(root, { ...opts, repos: [repo] });
+    const one = yield* analyzeSteps(root, { ...opts, repos: [repo] });
     merged.findings.push(...one.findings);
     merged.constructs.push(...one.constructs);
     merged.unstarted.push(...one.unstarted);
@@ -386,8 +406,9 @@ function analyzeEach(root, opts) {
   return merged;
 }
 
-export function scan(root, opts = {}) {
-  const res = analyzeEach(root, opts);
+export function* scanSteps(root, opts = {}) {
+  root = resolve(root);
+  const res = yield* analyzeEach(root, opts);
   const findings = [];
   for (const f of res.findings) {
     const meta = RULES[f.rule] || DEFAULT;
@@ -531,7 +552,8 @@ export function scan(root, opts = {}) {
       // happened to compute the right answer for the whole report - it ORs filesOverBudget in
       // separately - so nothing was wrong downstream, and nothing would have been until someone
       // called this set on its own and believed a silence.
-      coverageIncomplete: (res.stats.overBudget || 0) > 0
+      coverageIncomplete: (res.stats.files === 0 && directoryTree(root, opts).list().length === 0)
+        || (res.stats.overBudget || 0) > 0
         || (res.stats.filesNotReached || 0) > 0
         || (res.stats.unreadable || 0) > 0
         || (res.stats.threw || 0) > 0
@@ -570,6 +592,8 @@ export function scan(root, opts = {}) {
   return report;
 }
 
+export const scan = (root, opts = {}) => drive(scanSteps(root, opts));
+
 // Findings counted by the transaction or job that reaches them: the unit a mainframe team triages
 // in. A finding several entries reach counts under each.
 export function rollup(findings) {

package/lib/sets/hidden.mjs

@@ -4,7 +4,7 @@ import { cobolCard } from '../cards.mjs';
 import { decodeEbcdic, inScope, isJcl, isSource, looksEbcdic, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
-import { eachWithinMemory } from '../kernel/memory.mjs';
+import { drive, loopOver } from '../kernel/shared-pass.mjs';
 
 // Content a compiler ignores and an editor often hides, but an agent reading the source will see:
 // the sequence area, the identification area past column 72, comment lines, and characters that
@@ -154,14 +154,14 @@ const looksBinary = (buf) => {
   return odd / n > 0.05;
 };
 
-export function scanHidden(root, opts = {}) {
+export function* scanHiddenSteps(root, opts = {}) {
   const tree = treeFor(root, opts);
   const files = tree.list().filter(isSource).filter(inScope(opts));
   const findings = [];
   const stats = { filesScanned: 0, filesUnreadable: 0, filesBinary: 0, filesEbcdic: 0 };
   // This set reads every source file in the tree as raw bytes, which is the widest reading of the
   // nine, so it is the one most worth walking inside the guard.
-  const run = eachWithinMemory(files, (f) => {
+  const run = yield loopOver(files, (f) => {
     let buf;
     try { buf = tree.bytes(f); } catch (e) { noteUnread(stats, tree, f, e); return 0; }
     // An EBCDIC member is decoded before any rule reads it; read as bytes it looks binary, and a
@@ -210,3 +210,5 @@ export function scanHidden(root, opts = {}) {
 
   return report('hidden', { rules: HIDDEN_RULES, findings, stats, run });
 }
+
+export const scanHidden = (root, opts = {}) => drive(scanHiddenSteps(root, opts));