github
diff --git a/‎java/ql/lib/semmle/code/java/JDK.qll‎
Lines changed: 34 additions & 0 deletions b/‎java/ql/lib/semmle/code/java/JDK.qll‎
Lines changed: 34 additions & 0 deletions
@@ -3,6 +3,7 @@
  */
 
 import Member
+import semmle.code.java.security.ExternalProcess
 private import semmle.code.java.dataflow.FlowSteps
 
 // --- Standard types ---
@@ -197,6 +198,39 @@ class TypeFile extends Class {
 }
 
 // --- Standard methods ---
+/**
+ * DEPRECATED: Any constructor of class `java.lang.ProcessBuilder`.
+ */
+deprecated class ProcessBuilderConstructor extends Constructor, ExecCallable {
+  ProcessBuilderConstructor() { this.getDeclaringType() instanceof TypeProcessBuilder }
+
+  override int getAnExecutedArgument() { result = 0 }
+}
+
+/**
+ * DEPRECATED: Any of the methods named `command` on class `java.lang.ProcessBuilder`.
+ */
+deprecated class MethodProcessBuilderCommand extends Method, ExecCallable {
+  MethodProcessBuilderCommand() {
+    this.hasName("command") and
+    this.getDeclaringType() instanceof TypeProcessBuilder
+  }
+
+  override int getAnExecutedArgument() { result = 0 }
+}
+
+/**
+ * DEPRECATED: Any method named `exec` on class `java.lang.Runtime`.
+ */
+deprecated class MethodRuntimeExec extends Method, ExecCallable {
+  MethodRuntimeExec() {
+    this.hasName("exec") and
+    this.getDeclaringType() instanceof TypeRuntime
+  }
+
+  override int getAnExecutedArgument() { result = 0 }
+}
+
 /**
  * Any method named `getenv` on class `java.lang.System`.
  */