Analyze classified COBOL DISPLAY exposure

Proprietary

Inventory direct field and group DISPLAY operands that expose explicitly classified no-output declarations. Resolve declarations in the configured source and program. Report missing classifications, incomplete source and unsupported operands. Does not infer sensitivity from names, propagate values through assignments, follow aliases, evaluate expressions, prove reachability or alter logging. Findings require an approved protection pattern and audit contract before remediation.

io.moderne.mainframe.security.AnalyzeSensitiveDisplays

Required

sourcePathString

Exact repository-relative COBOL source path covered by the classification contract. Globs are not supported.

programNameString

Program ID covered by the classification contract. Retain quotes for literal IDs. Their contents match case exactly. Nested programs have their own scope.

prohibitedFieldsList

Approved sensitive declarations prohibited in every DISPLAY destination in this program. Use exact outermost-first dotted declaration names, including every ancestor (for example RECORD.FIELD). A classified group covers its descendants. Names are never inferred to be sensitive. No regular expressions or globs. Separate values with commas.

contractSourceString

Required provenance of the approved no-DISPLAY classification for these fields, such as a repository path and version or an approved input reference. Recorded as evidence. The reference is not fetched or interpreted as policy.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeSensitiveDisplays \
  -P sourcePath=security/cbl/VSLOGBAD.cbl \
  -P programName=VSLOGBAD \
  -P prohibitedFields='[VS-INBOUND.VS-GOVERNMENT-ID]' \
  -P contractSource='mainframe-fixtures/README.md: fictional security contracts'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.