fix(java): catch chained ProcessBuilder command injection

java/lang/security/audit/command-injection-process-builder.java

@@ -49,3 +49,36 @@ public String okTest() {
 
 
 }
+
+class ProcessBuilderChainedAndLaterArgs {
+    public void chainedCommand(String userInput) {
+        // ruleid: command-injection-process-builder
+        new ProcessBuilder().command(userInput);
+    }
+
+    public void chainedCommandSplit(String userInput) {
+        // ruleid: command-injection-process-builder
+        ProcessBuilder builder = new ProcessBuilder().command(userInput.split(" "));
+    }
+
+    public void dynamicArgInConstructor(String userInput) {
+        // ok: command-injection-process-builder
+        ProcessBuilder builder = new ProcessBuilder("ls", userInput);
+    }
+
+    public void dynamicArgInCommand(String userInput) {
+        ProcessBuilder builder = new ProcessBuilder();
+        // ok: command-injection-process-builder
+        builder.command("java", "-jar", userInput);
+    }
+
+    public void allArgumentsAreLiterals() {
+        // ok: command-injection-process-builder
+        ProcessBuilder builder = new ProcessBuilder("ls", "-la");
+    }
+
+    public void chainedCommandWithLiterals() {
+        // ok: command-injection-process-builder
+        new ProcessBuilder().command("ls", "-la");
+    }
+}

java/lang/security/audit/command-injection-process-builder.yaml

@@ -19,6 +19,24 @@ rules:
         new ProcessBuilder(new String[]{"...",...},...)
     - pattern-not: |
         new ProcessBuilder(Arrays.asList("...",...),...)
+  - patterns:
+    - pattern: |
+        new ProcessBuilder().command($CMD,...)
+    - pattern-not-inside: |
+        $CMD = "...";
+        ...
+    - pattern-not-inside: |
+        $CMD = Arrays.asList("...",...);
+        ...
+    - pattern-not-inside: |
+        $CMD = new String[]{"...",...};
+        ...
+    - pattern-not: |
+        new ProcessBuilder().command("...",...)
+    - pattern-not: |
+        new ProcessBuilder().command(new String[]{"...",...},...)
+    - pattern-not: |
+        new ProcessBuilder().command(Arrays.asList("...",...),...)
   - patterns:
     - pattern: |
         $PB.command($CMD,...)