@@ -10,46 +10,114 @@ import semmle.code.java.Collections
 
 /**
  * Holds if `ex` is used safely as an argument to a command;
- * i.e. it's not in the first position and it's not a shell command.
+ * i.e. it's not in a position that selects a command to execute.
  */
 predicate isSafeCommandArgument(Expr ex) {
-  exists(ArrayInit ai, int i |
-    ex = ai.getInit(i) and
+  exists(CommandArguments arguments, int i |
     i > 0 and
-    not isShell(ai.getInit(0))
-  )
-  or
-  exists(CommandArgumentList cal |
-    not cal.isShell() and
-    ex = cal.getASubsequentAdd().getArgument(0)
-  )
-  or
-  exists(CommandArgArrayImmutableFirst caa |
-    not caa.isShell() and
-    ex = caa.getAWrite(any(int i | i > 0))
+    ex = arguments.getArgumentUse(i) and
+    arguments.hasSafeArgument(i)
   )
 }
 
-/**
- * Holds if the given expression is the name of a shell command such as bash or python
- */
-private predicate isShell(Expr ex) {
-  exists(string cmd | cmd = ex.(StringLiteral).getValue() |
-    cmd.regexpMatch(".*(sh|javac?|python[23]?|osascript|cmd)(\\.exe)?$")
-  )
+private string commandName(Expr ex) {
+  result = ex.(StringLiteral).getValue()
   or
   exists(SsaDefinition ssa, SsaExplicitWrite def |
     ex = ssa.getARead() and
-    isShell(def.getDefiningExpr())
+    result = commandName(def.getDefiningExpr())
   |
     ssa.getAnUltimateDefinition() = def
     or
     ssa.(SsaCapturedDefinition).getAnUltimateCapturedDefinition() = def
   )
   or
-  isShell(ex.(Assignment).getRhs())
+  result = commandName(ex.(Assignment).getRhs())
   or
-  isShell(ex.(LocalVariableDeclExpr).getInit())
+  result = commandName(ex.(LocalVariableDeclExpr).getInit())
+}
+
+/**
+ * Holds if the given expression is the name of a shell command such as bash or python
+ */
+private predicate isShell(Expr ex) {
+  commandName(ex).regexpMatch(".*(sh|javac?|python[23]?|osascript|cmd)(\\.exe)?$")
+}
+
+/**
+ * Gets the fixed position of the command executed by a supported delegating launcher.
+ *
+ * Only simple invocation forms are recognized. Launcher options are intentionally not parsed.
+ */
+private int delegatedCommandIndex(Expr ex) {
+  exists(string launcher |
+    launcher = commandName(ex).regexpCapture("(.*/)?([^/.]+)(\\.exe)?$", 2) and
+    (
+      launcher = ["env", "nice", "nohup", "setsid", "sudo", "xargs"] and result = 1
+      or
+      launcher = ["chroot", "stdbuf", "timeout"] and result = 2
+    )
+  )
+}
+
+private newtype TCommandArguments =
+  TLiteralArguments(ArrayInit init) or
+  TListArguments(CommandArgumentList list) or
+  TMutableArguments(CommandArgArrayImmutableFirst array)
+
+/** An ordered sequence of command arguments. */
+private class CommandArguments extends TCommandArguments {
+  string toString() { result = this.getArgument(0).toString() }
+
+  /** Gets a possible value at the given index. */
+  private Expr getArgument(int index) {
+    exists(ArrayInit init | this = TLiteralArguments(init) | result = init.getInit(index))
+    or
+    exists(CommandArgumentList list |
+      this = TListArguments(list) and
+      result = list.getArgument(index)
+    )
+    or
+    exists(CommandArgArrayImmutableFirst array |
+      this = TMutableArguments(array) and
+      result = array.getAnElement(index)
+    )
+  }
+
+  /** Gets an expression whose value is stored at the given index. */
+  Expr getArgumentUse(int index) {
+    exists(ArrayInit init | this = TLiteralArguments(init) | result = init.getInit(index))
+    or
+    exists(CommandArgumentList list |
+      this = TListArguments(list) and
+      result = list.getArgument(index)
+    )
+    or
+    exists(CommandArgArrayImmutableFirst array |
+      this = TMutableArguments(array) and
+      result = array.getAWrite(index)
+    )
+  }
+
+  predicate hasSafeArgument(int index) {
+    exists(this.getArgumentUse(index)) and
+    not isShell(this.getArgument(0)) and
+    (
+      not exists(delegatedCommandIndex(this.getArgument(0)))
+      or
+      exists(int commandIndex |
+        commandIndex = delegatedCommandIndex(this.getArgument(0)) and
+        (
+          index < commandIndex
+          or
+          index > commandIndex and
+          exists(this.getArgument(commandIndex)) and
+          not isShell(this.getArgument(commandIndex)) and
+          not exists(delegatedCommandIndex(this.getArgument(commandIndex)))
+        )
+      )
+    )
+  }
 }
 
 /**
@@ -101,16 +169,25 @@ private class CommandArgumentList extends SsaExplicitWrite {
     result.getQualifier() = this.getAUseBeforeFirstAdd()
   }
 
-  /** Gets an addition to this list which is not the first element. */
-  MethodCall getASubsequentAdd() {
-    result = this.getAnAdd() and
-    not result = this.getAFirstAdd()
+  /** Gets a single-element addition at the given index. */
+  private MethodCall getAnAddAtIndex(int index) {
+    index = 0 and
+    result = this.getAFirstAdd() and
+    result.getMethod().hasName("add") and
+    result.getNumArgument() = 1
+    or
+    index > 0 and
+    exists(MethodCall previous |
+      previous = this.getAnAddAtIndex(index - 1) and
+      result = this.getAnAdd() and
+      result.getMethod().hasName("add") and
+      result.getNumArgument() = 1 and
+      adjacentUseUse(previous.getQualifier(), result.getQualifier())
+    )
   }
 
-  /** Holds if the first element of this list is a shell command. */
-  predicate isShell() {
-    exists(MethodCall ma | ma = this.getAFirstAdd() and isShell(ma.getArgument(0)))
-  }
+  /** Gets the argument added at the given index. */
+  Expr getArgument(int index) { result = this.getAnAddAtIndex(index).getArgument(0) }
 }
 
 /**
@@ -153,7 +230,7 @@ private class CommandArgumentArray extends SsaExplicitWrite {
  */
 private class CommandArgArrayImmutableFirst extends CommandArgumentArray {
   CommandArgArrayImmutableFirst() {
-    (exists(this.getAWrite(0)) or exists(firstElementOf(this.getDefiningExpr()))) and
+    (exists(this.getAWrite(0)) or exists(arrayElementOf(this.getDefiningExpr(), 0))) and
     forall(VarRead use | exists(this.getAWrite(0, use)) | use = ssaGetAFirstUse(this))
   }
 
@@ -162,41 +239,50 @@ private class CommandArgArrayImmutableFirst extends CommandArgumentArray {
     result = this.getAWrite(0)
     or
     not exists(this.getAWrite(0)) and
-    result = firstElementOf(this.getDefiningExpr())
+    result = arrayElementOf(this.getDefiningExpr(), 0)
   }
 
-  /** Holds if the first element of this array is a shell command. */
-  predicate isShell() { isShell(this.getFirstElement()) }
+  /** Gets a possible value for the element at the given index. */
+  Expr getAnElement(int index) {
+    index = 0 and result = this.getFirstElement()
+    or
+    index > 0 and
+    (
+      result = this.getAWrite(index)
+      or
+      result = arrayElementOf(this.getDefiningExpr(), index)
+    )
+  }
 }
 
-/** Gets the first element of an imutable array of strings */
-private Expr firstElementOf(Expr arr) {
+/** Gets an element of an immutable array of strings. */
+private Expr arrayElementOf(Expr arr, int index) {
   arr.getType() instanceof ArrayOfStringType and
   (
-    result = firstElementOf(arr.(Assignment).getRhs())
+    result = arrayElementOf(arr.(Assignment).getRhs(), index)
     or
-    result = firstElementOf(arr.(LocalVariableDeclExpr).getInit())
+    result = arrayElementOf(arr.(LocalVariableDeclExpr).getInit(), index)
     or
     exists(CommandArgArrayImmutableFirst caa | arr = caa.getARead() |
-      result = caa.getFirstElement()
+      result = caa.getAnElement(index)
     )
     or
     exists(MethodCall ma, Method m |
       arr = ma and
       ma.getMethod() = m and
       m.getDeclaringType().hasQualifiedName("java.util", "Arrays") and
       m.hasName("copyOf") and
-      result = firstElementOf(ma.getArgument(0))
+      result = arrayElementOf(ma.getArgument(0), index)
     )
     or
     exists(Field f |
       f.isStatic() and
       arr.(FieldRead).getField() = f and
-      result = firstElementOf(f.getInitializer())
+      result = arrayElementOf(f.getInitializer(), index)
     )
     or
-    result = arr.(ArrayInit).getInit(0)
+    result = arr.(ArrayInit).getInit(index)
     or
-    result = arr.(ArrayCreationExpr).getInit().getInit(0)
+    result = arr.(ArrayCreationExpr).getInit().getInit(index)
   )
 }