Analyze current TSQ payload lengths before parser calls

Proprietary

Prove that the exact parser call consumes the unchanged original length returned by a successful READQ TS. Require a known positive request maximum within the complete local PIC X buffer, an explicit signed halfword LENGTH, ITEM and fullword RESP. Require a complete terminal rejection of every response other than NORMAL before using length checks to establish the approved nonempty range. Support numeric comparisons, Boolean combinations and numeric level-88 length ranges. Track each read for at most 64 following statements and returning branches for at most 16 levels. Writes, calls, unsupported effects and later reads discard earlier evidence. Constants and recomputed capacity or trimmed length cannot establish a current returned count. Require complete ordinary source and disjoint storage. Preserve source and existing handler behavior. Queue ownership, freshness, queue-name trust, authorization, whitespace rules and payload syntax remain separate requirements. Report evidence without vulnerability findings.

io.moderne.mainframe.security.AnalyzeCurrentTsqPayloadLength

Required

Exact repository-relative source covered by the payload contract.

Exact program ID. Retain quotes for a literal ID.

Exact literal CALL target approved to consume the configured payload and content length.

One to 16 distinct outermost-first dotted declarations of complete records. The call must pass these records in this order by reference. The contract must establish their addressability and disjointness. Separate values with commas.

Exact outermost-first dotted PIC X field with one to 32767 characters. The READQ output must be ordinary local storage. Its safe request maximum is proved from the caller.

Exact ordinary local integer field consumed by the parser. READQ requires signed halfword COMP or BINARY storage.

Approved upper bound from one through the payload capacity. The approved minimum is one.

Provenance of the exact parser interface and addressable disjoint records. The parser consumes precisely the returned number of characters, including spaces. The recipe records this input and does not infer or fetch it.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeCurrentTsqPayloadLength \ -P sourcePath=security/cbl/VSTPGOOD.cbl \ -P programName=VSTPGOOD \ -P parserRoutine=VSTPARSE \ -P parserArguments='[VS-PAYLOAD]' \ -P payloadField=VS-PAYLOAD.VS-PAYLOAD-TEXT \ -P lengthField=VS-PAYLOAD.VS-PAYLOAD-LENGTH \ -P maximumContentLength=8 \ -P contractSource='mainframe-fixtures fictional TSQ payload parser contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.