Find SQL status overwritten before inspection

Proprietary

Find executable EXEC SQL statements followed by another executable SQL statement in the same COBOL statement sequence, before SQLCODE or SQLSTATE can be inspected. Follow lexical WHENEVER directives, including CONTINUE resets, and decline to claim a vulnerability when a handler, unresolved source or unparsed SQL requires further analysis. Report evidence and missing error-handling contracts as finding only. Does not infer accepted SQLCODE values, prove reachability, follow calls or jumps, or certify checks in other statement shapes. CONTINUE and simple EXIT do not inspect the result. Other EXIT forms remain barriers. Plain DISPLAY of quoted ASCII text preserves local fields and does not inspect a status value or terminate processing. Accept at most 16 literals of at most 256 characters each. Device options, screen positioning, exception clauses, field reads and functions remain barriers. Programs with unmodeled declaratives remain incomplete source. Skip bounded literal MOVE, SET TO TRUE and plain INITIALIZE only when every write is to ordinary storage disjoint from SQL diagnostics. Protect SQLCODE, SQLSTATE, SQLCA and their modeled containing groups, members and aliases. MOVE from fields and diagnostic reads remain barriers. Validate every target before accepting an assignment. Limit MOVE and SET to 16 targets and text literals to 256 ASCII characters. Integer literals have at most 18 digits and must fit numeric receivers. Initialization permits at most 16 targets and 64 elementary writes. Unknown storage, unsupported assignments and writes to diagnostic fields prevent this extension. These assignments do not inspect the earlier SQL result. They do not establish success or an approved failure policy. Preserve diagnostic lifetimes across bounded STRING DELIMITED BY SIZE statements that neither read nor write diagnostic storage. Require every field operand and the receiver to be ordinary PIC X storage disjoint from the diagnostic fields and their containing groups. Accept at most 16 operands and at most 256 characters per field. Require the complete write to fit the receiver. Overlap, pointers, overflow handlers, other delimiters and unsupported operands remain barriers. This does not establish that an earlier command succeeded or that its output is valid. Only a complete WHENEVER condition CONTINUE directive resets its lexical handler. Unsupported trailing syntax retains a handler barrier. INITIALIZE VALUE and FILLER phrases require a separate effect proof and discard default-assignment facts. An explicit TO DEFAULT without a VALUE, FILLER or replacement phrase retains the default behavior.

io.moderne.mainframe.security.FindOverwrittenSqlStatus
mod run . --recipe=io.moderne.mainframe.security.FindOverwrittenSqlStatus

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.