Java: detect command injection through delegating launchers

[Copilot]

isSafeCommandArgument treated non-first arguments as safe whenever the executable was not a recognized shell. Delegating launchers could therefore execute attacker-controlled arguments without producing a command-line injection alert.

• Detection

  • Distinguish delegating launchers from shells.
  • Recognize env, sudo, xargs, chroot, nice, nohup, setsid, stdbuf, and timeout.
  • Apply detection to array literals, mutable arrays, and command lists.

• Coverage

  • Add an alert case for each recognized launcher.
  • Preserve safe handling for non-delegating commands such as cp.

Runtime.getRuntime().exec(new String[]{"env", userControlledInput});

[owen-mc]

The new check disables sanitization for every argument after a launcher. For example:

new ProcessBuilder(new String[]{"env", "/bin/cp", userInput, "/tmp/destination"});

This now produces java/command-line-injection, although userInput remains a discrete argument to the fixed /bin/cp executable. This contradicts the safe direct-cp behavior tested at Test.java:48 and introduces false positives into a high-precision query.

Make launcher handling position-aware: flag the operand selecting the delegated command, then preserve normal safe-argument handling once a fixed non-shell command is known. Add GOOD cases for array literals, lists, and mutable arrays.

[owen-mc]

Common launchers such as flock, su, runuser, doas, and time remain unrecognized. For example, taint in {"flock", "/tmp/lock", userInput} is still sanitized even though userInput selects the executed command. This matches the existing unresolved review thread.

[owen-mc]

@copilot Please address the three comments on this PR.

[Copilot]

@copilot Please address the three comments on this PR.

Addressed all three comments in edb67fe and 866d93b. Launcher handling now preserves safe arguments after fixed non-shell commands, recognizes the missing wrappers, and includes GOOD cases for literals, lists, and mutable arrays. Added safeguards and regressions for unresolved commands and mutated aliases. All four CWE-078 tests pass; final read-only review found no issues. The automated security scan was skipped because its database was too large.