feat(java): detect cmd.exe ArgumentListBuilder.addTokenized (CWE-78)

[ai-anant]

Summary

Adds a Jenkins/Java rule that flags ArgumentListBuilder.addTokenized(...) used on a command list that also contains cmd.exe.

On Windows, Launcher reconstructs the token list into a command line that cmd.exe re-parses. Whitespace-split non-literal input (job parameters, process output, workspace file lines) can therefore inject cmd metacharacters as extra commands.

Pattern (generic)

ArgumentListBuilder b = new ArgumentListBuilder();
b.add("cmd.exe");
b.add("/c");
b.addTokenized(untrusted);
launcher.launch().cmds(b);

Quiet when addTokenized is a string literal, when the builder never adds cmd.exe, or when the untrusted value is passed with add() (one argv slot, no tokenize).

Why

addTokenized is often assumed safe because it builds an argv list rather than a shell string. That assumption fails once cmd.exe is the executable: the shell metacharacters become separate tokens and are then interpreted by cmd.

Validation

• semgrep --validate --config java/ clean
• Positive repro (cmd.exe + addTokenized of a non-literal) fires
• Negative repro (literal tokenize / no cmd.exe / add() not addTokenized) silent