Developer’s Artifacts typically involved in COBOL programming are COBOL sources, CopyBooks, DDL, DML, DCLGEN, Screen MAPs and JCL. Security Reviewer analyzes them all. IMS, DL/I and several DBs are also supported.
Normally you should download your source code yourself and analyse it manually. Security Reviewer will help you on automating it. Security Reviewer ALM can download your source code from DEV, QA/Stage or PROD Environments at the push of a button, through integration with Broadcom CA-AllFusion Endevor® CM (Mainframe) and AllFusion Harvest® SCM (Windows, Linux)
It also integrates with GIT, SVN, Microsoft TFS, IBM Rational Team Concert, Micro Focus PVCS and CVS (Windows, Linux). It provides a .NET Core Command Line: a multi-platform (Windows, Linux) simple-syntax command line for being launched or scheduled in your AllFusion Harvest Workbench or into your preferred IDE, as an external command. That can be useful for integrating Security Reviewer’s Static Analysis in your Development Life Cycle.
For each COBOL Platform, different rules will be applied. You can choose:
Target COBOL Version
Statement Length: 88, 132 or free format
Consider the Working Storage as Untrusted
Allow/Disallow CICS System Programming
COPYBOOKS folder location
Security Reviewer supports most of COBOL Language platforms:
It support all modern COBOL Versions:
IBM z/OS Enterprise COBOL
IBM IL COBOL (iSeries)
Visual COBOL (Micro Focus)
GnuCOBOL (formerly openCOBOL)
Teradata IMS (COBOL)
Elastic COBOLVeryant isCOBOL Evolve
It also supports Legacy Versions, like:
Different SQL Dialects are supported for COBOL:
Rules for each SQL Dialect will be applied differently.
Further, suppose you have a Java or C# Front End and a COBOL Back End. Security Reviewer can analyse the whole source code simultaneusly, applying different rules for each programming language, and giving a single Result and Report.
Security vulnerabilities, Dead Code, Best Practices, Insufficient Control Flow Management, PossibleBugs and Resilience will be detected performing a Static Application Security Test (SAST).
Our Static Analysis can handle very large COBOL Programs. Until now the largest program we analyzed was 193 MLOC in a single file. Example of vulnerabilities categories that can be detected:
Access Control Database, Access Control DLI, Access Control MQSeries
Unused Parameter, Unused Label, Unused PERFORM, Unused data structures
Once the analysis is terminated, you can view and manage the results. You can mark some vulnerabilities as False Positive, Suppress Vulnerabilities, and you can add Notes or change the Vulnerability’ Status.
Dead code - Best Practices and Possible Bugs
The same you can do for Dead Code, Best Practices, and Resilience.
Our reporting system provides a bunch of options:
Generate reports in different formats (PDF, Word, Excel, HTML, CSV, JSON)
Generate separate reports for each Component
Include False Positives and Excluded File list in the report
Configure the ISO 9001 Cover page
Include PCI-DSS 3.2.1 issues
Sort vulnerabilities per Severity, CVSS, OWASP, CWE
In case you won’t include source code snippets in the report, you have ‘Binary Only’ option
Choose which Severity Level issues will be reported
Choose between Summary, Details or Developer reports for Security, Dead Code-Best Practices, Quality and SQALE
SQALE Reports can include Security, Dead Code, Best-Practices, Quality and Resilience and are provided in English, Spanish, Russian and Italian. A Translation Kit is provided.
Security Reviewer provides a Quality feature, 100% compatible with McCabe IQ®, able to calculate COBOL Software Quality Metrics, and focused to manage COBOL Programs on a Quality point-of-view as well as some significant Performance issue. COBOL metrics are automatically calculated, such as: LOC, SLOC, Cyclomatic Complexity, Essential Complexity, Developer Effort, Comment Ratio, #Subroutines, #Parameters, SQL Quality, etc.
First Quality view shows most used Metrics, with out-of-range values:
COPYRIGHT (C) 2015-2023 SECURITY REVIEWER SRL. ALL RIGHTS RESERVED.