Propose measuring payload content length

Proprietary

Propose replacing one approved capacity COMPUTE with FUNCTION LENGTH of FUNCTION TRIM TRAILING. Require exact caller and COPY snapshots and the complete input and padding contract. Changing only the computation must establish the approved nonempty content range at the selected parser CALL. Reuse the existing terminal checks within 64 following statements. Earlier consumers before the full range check, later mutations and unknown effects prevent a proposal. Preserve sentence periods, leading comments and final trivia. Require a direct fixed-format computation without internal comments or following same-line executable statements. Report CWE-20 only for an adjacent whole-field all-space assignment followed by capacity checks that allow the parser call. The proof is conditional on reaching that assignment. If the available parser cannot construct the approved expression, report that capability barrier without changing source. Other approved corrections do not imply a vulnerability finding. Application-team review of the exact correction and existing failure behavior remains required. Transport length, general whitespace handling and payload syntax are not established.

io.moderne.mainframe.security.ProposePayloadContentLength

Required

Exact repository-relative source covered by the payload contract.

Exact program ID. Retain quotes for a literal ID.

Exact literal CALL target approved to consume the configured payload and content length.

One to 16 distinct outermost-first dotted declarations of complete records. The call must pass these records in this order by reference. The contract must establish their addressability and disjointness. Separate values with commas.

Exact outermost-first dotted PIC X field with one to 32767 characters. Its complete input must fit without upstream truncation. Local storage and explicitly approved incoming records are supported.

Exact ordinary local integer field consumed by the parser. Support DISPLAY, binary and packed decimal representations of at most 18 digits that represent zero through the payload capacity.

Approved upper bound from one through the payload capacity. The approved minimum is one.

Explicit approval that trailing spaces are padding and leading spaces are content. False reports that the required padding contract is missing.

Provenance of the complete input, padding policy, parser interface and addressable disjoint records. Explicitly approve replacing capacity with content length at the selected computation. Approve the existing range checks and failure behavior. Preserve required messages, cleanup and transaction behavior.

Lowercase SHA-256 of the complete original UTF-8 caller without a byte order mark. Any caller change prevents application.

JSON object containing the independently approved SHA-256 of every resolved data COPY. Use uppercase names and lowercase hashes. Changed, missing or extra dependencies prevent application.

One-based line selecting exactly one approved plain capacity COMPUTE.

One-based line selecting exactly one approved parser CALL.

mod run . --recipe=io.moderne.mainframe.security.ProposePayloadContentLength \ -P sourcePath=security/cbl/VSPDGOOD.cbl \ -P programName=VSPDGOOD \ -P parserRoutine=VSPARSE \ -P parserArguments='[VS-PAYLOAD]' \ -P payloadField=VS-PAYLOAD.VS-PAYLOAD-TEXT \ -P lengthField=VS-PAYLOAD.VS-PAYLOAD-LENGTH \ -P maximumContentLength=8 \ -P trailingSpacesArePadding=true \ -P contractSource='mainframe-fixtures fictional current payload length contract' \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P computationLine=11 \ -P parserLine=17

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.