Address launcher review feedback

Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>

Author: Copilot

java/ql/lib/semmle/code/java/security/CommandArguments.qll

@@ -71,7 +71,7 @@ private predicate isShell(Expr ex) {
  */
 private predicate isDelegatingLauncher(Expr ex) {
   commandName(ex)
-      .regexpMatch("(.*/)?(busybox|chroot|doas|env|flock|ionice|nice|nohup|runuser|script|setsid|stdbuf|su|sudo|taskset|time|timeout|unbuffer|watch|xargs)$")
+      .regexpMatch("(.*/)?(busybox|chroot|doas|env|flock|ionice|nice|nohup|runuser|script|setsid|stdbuf|su|sudo|taskset|time|timeout|unbuffer|watch|xargs)(\\.exe)?$")
 }
 
 private string commandName(Expr ex) {
@@ -104,9 +104,10 @@ private string fixedCommandName(Expr ex) {
   exists(SsaDefinition ssa |
     ex = ssa.getARead() and
     result =
-      fixedCommandName(any(SsaExplicitWrite def | def = ultimateDefinition(ssa)).getDefiningExpr())
+      fixedCommandName(any(ultimateDefinition(ssa).(SsaExplicitWrite)).getDefiningExpr())
   |
     forall(SsaDefinition def | def = ultimateDefinition(ssa) |
+      def instanceof SsaExplicitWrite and
       fixedCommandName(def.(SsaExplicitWrite).getDefiningExpr()) = result
     )
   )
@@ -161,9 +162,11 @@ private class CommandArguments extends TCommandArguments {
   /**
    * Gets a command operand after skipping only understood options and required operands.
    * Shell-interpreting forms (such as `su -c`, `watch`, and `script -c`) are not skipped.
+   * @param launcher The basename of the launcher.
+   * @param index The argument index to inspect.
+   * @param options Whether launcher options may be skipped.
    */
   private int commandOperand(string launcher, int index, boolean options) {
-    launcher = this.getFixedArgument(_).regexpCapture("(.*/)?([^/]+)", 2) and
     options = [true, false] and
     exists(Expr arg | arg = this.getArgument(index) |
       (options = false or not this.getFixedArgument(index).matches("-%")) and
@@ -189,7 +192,7 @@ private class CommandArguments extends TCommandArguments {
 
   private int delegatedCommand(int index) {
     exists(string launcher |
-      launcher = this.getFixedArgument(index).regexpCapture("(.*/)?([^/]+)", 2) and
+      launcher = this.getFixedArgument(index).regexpCapture("(.*/)?([^/.]+)(\\.exe)?$", 2) and
       isDelegatingLauncher(this.getArgument(index)) and
       (
         exists(int start |
@@ -230,7 +233,7 @@ private class CommandArguments extends TCommandArguments {
   predicate hasSafeArgument(int index) { this.safeAfter(0, index) }
 }
 
-private ArrayInit arrayInitializerOf(Expr ex) { result = containerOrigin(ex).(ArrayInit) }
+private ArrayInit arrayInitializerOf(Expr ex) { result = containerOrigin(ex) }
 
 /** Gets a container's allocation or initializer, including through local aliases. */
 private Expr containerOrigin(Expr ex) {
@@ -347,7 +350,7 @@ private predicate launcherOption(string launcher, string option, int width) {
     or
     launcher = "sudo" and option = ["-u", "-g", "--user", "--group"]
     or
-    launcher = "doas" and option = ["-u"]
+    launcher = "doas" and option = "-u"
     or
     launcher = "time" and option = ["-o", "-f", "--output", "--format"]
     or

java/ql/test/query-tests/security/CWE-078/Test.java

@@ -52,6 +52,7 @@ public static void nonShellCommand(String arg) throws java.io.IOException {
   public static void delegatingLaunchers(String arg) throws java.io.IOException {
     new ProcessBuilder(new String[]{"chroot", "/tmp/root", arg}).start(); // $ Alert[java/command-line-injection] Alert[java/relative-path-command]
     new ProcessBuilder(new String[]{"env", arg}).start(); // $ Alert[java/command-line-injection] Alert[java/relative-path-command]
+    new ProcessBuilder(new String[]{"env.exe", arg}).start(); // $ Alert[java/command-line-injection] Alert[java/relative-path-command]
     new ProcessBuilder(new String[]{"nice", arg}).start(); // $ Alert[java/command-line-injection] Alert[java/relative-path-command]
     new ProcessBuilder(new String[]{"nohup", arg}).start(); // $ Alert[java/command-line-injection] Alert[java/relative-path-command]
     new ProcessBuilder(new String[]{"setsid", arg}).start(); // $ Alert[java/command-line-injection] Alert[java/relative-path-command]
@@ -131,7 +132,7 @@ public static void launcherArguments(String arg) throws java.io.IOException {
     new ProcessBuilder(changedLiteral).start(); // $ Alert[java/command-line-injection]
 
     String[] unknownIndex = new String[]{"/usr/bin/env", "/bin/cp", "-c", arg};
-    unknownIndex[arg.length()] = "/bin/sh";
+    unknownIndex[arg.length() % unknownIndex.length] = "/bin/sh";
     new ProcessBuilder(unknownIndex).start(); // $ Alert[java/command-line-injection]
 
     String[] conditionalArray = new String[]{"/usr/bin/env", "/bin/sh", "-c", "<command>"};