diff --git a/java/app_builder.go b/java/app_builder.go
index 954ca44..e27b1b7 100644
--- a/java/app_builder.go
+++ b/java/app_builder.go
@@ -103,10 +103,10 @@
 			`cp ${manifest} ${outDir}/AndroidManifest.xml && ` +
 			`cp ${classesJar} ${outDir}/classes.jar && ` +
 			`cp ${rTxt} ${outDir}/R.txt && ` +
-			`${config.SoongZipCmd} -jar -o $out -C ${outDir} -D ${outDir} ${resArgs}`,
+			`${config.SoongZipCmd} -jar -o $out -C ${outDir} -D ${outDir}`,
 		CommandDeps: []string{"${config.SoongZipCmd}"},
 	},
-	"manifest", "classesJar", "rTxt", "resArgs", "outDir")
+	"manifest", "classesJar", "rTxt", "outDir")
 
 func BuildAAR(ctx android.ModuleContext, outputFile android.WritablePath,
 	classesJar, manifest, rTxt android.Path, res android.Paths) {
diff --git a/java/builder.go b/java/builder.go
index 48b5a7b..07af8eb 100644
--- a/java/builder.go
+++ b/java/builder.go
@@ -321,7 +321,7 @@
 		Output:      outputFile,
 		Implicits:   deps,
 		Args: map[string]string{
-			"jarArgs": strings.Join(proptools.NinjaEscape(jarArgs), " "),
+			"jarArgs": strings.Join(proptools.NinjaAndShellEscape(jarArgs), " "),
 		},
 	})
 }
diff --git a/java/java_resources.go b/java/java_resources.go
index fdc1590..4d8a757 100644
--- a/java/java_resources.go
+++ b/java/java_resources.go
@@ -20,6 +20,8 @@
 	"strings"
 
 	"android/soong/android"
+
+	"github.com/google/blueprint/pathtools"
 )
 
 var resourceExcludes = []string{
@@ -64,7 +66,7 @@
 					if !strings.HasPrefix(path, dir.String()) {
 						panic(fmt.Errorf("path %q does not start with %q", path, dir))
 					}
-					args = append(args, "-f", path)
+					args = append(args, "-f", pathtools.MatchEscape(path))
 				}
 			}
 		}
@@ -107,7 +109,7 @@
 		if i == 0 || dir != lastDir {
 			args = append(args, "-C", dir)
 		}
-		args = append(args, "-f", path)
+		args = append(args, "-f", pathtools.MatchEscape(path))
 		lastDir = dir
 	}
 
diff --git a/zip/cmd/main.go b/zip/cmd/main.go
index dfd56dc..f49105a 100644
--- a/zip/cmd/main.go
+++ b/zip/cmd/main.go
@@ -199,6 +199,11 @@
 
 	flags.Parse(expandedArgs[1:])
 
+	if flags.NArg() > 0 {
+		fmt.Fprintf(os.Stderr, "unexpected arguments %s\n", strings.Join(flags.Args(), " "))
+		usage()
+	}
+
 	err := zip.Run(zip.ZipArgs{
 		FileArgs:                 fArgs,
 		OutputFilePath:           *out,
diff --git a/zip/zip.go b/zip/zip.go
index 6b36e10..4a02531 100644
--- a/zip/zip.go
+++ b/zip/zip.go
@@ -224,9 +224,20 @@
 	noCompression := args.CompressionLevel == 0
 
 	for _, fa := range args.FileArgs {
-		srcs := fa.SourceFiles
+		var srcs []string
+		for _, s := range fa.SourceFiles {
+			globbed, _, err := pathtools.Glob(s, nil, pathtools.DontFollowSymlinks)
+			if err != nil {
+				return err
+			}
+			srcs = append(srcs, globbed...)
+		}
 		if fa.GlobDir != "" {
-			srcs = append(srcs, recursiveGlobFiles(fa.GlobDir)...)
+			globbed, _, err := pathtools.Glob(filepath.Join(fa.GlobDir, "**/*"), nil, pathtools.DontFollowSymlinks)
+			if err != nil {
+				return err
+			}
+			srcs = append(srcs, globbed...)
 		}
 		for _, src := range srcs {
 			err := fillPathPairs(fa, src, &pathMappings, args.NonDeflatedFiles, noCompression)