feat(java): detect ProcessBuilder command/arguments built from macro/override-expanded values (CWE-88)

[ai-anant]

Summary

New Java rule for the java/ tree: detects a java.lang.ProcessBuilder command (or an argument appended to it via .add(...)/.command(...)) that is assembled from a value produced by environment/macro expansion or an override-map lookup — env.expand(...), hudson.Util.replaceMacro(...), a getOverride(...) / getValue(overrides) resolver, or a Map.get(...) on an override map.

Why

Such values are frequently sourced from build parameters / host environment that a less-privileged caller can influence. Because the expanded text is appended verbatim into the process argv, a crafted value can inject additional option verbs (argument injection, CWE-88), which can override flags the invoking program sets (e.g. a credential/--token/namespace option or client impersonation flags) and can escalate to command injection (CWE-78) wherever a shell later interprets the assembled string.

Rule

• id: codevigilant.java.jenkins.command-injection.processbuilder-macro-expanded-argument
• path: java/jenkins/command-injection/processbuilder-macro-expanded-argument.yaml
• severity: HIGH
• languages: java
• metadata: CWE-88 / OWASP A03:2021 (Injection), technology jenkins

Validation

• semgrep --validate --config java/ passes (0 configuration errors).
• Fires on a positive repro (.add(env.expand(...)), .add(getOverride(...)) after new ProcessBuilder()), 0 findings on a literal-only negative repro.

Test

semgrep --config java/ <positive.java>   # matches
semgrep --config java/ <negative.java>   # 0 matches