Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func TestParseFilters(t *testing.T) {
	filterExpression := "eq(foo, 123)+ne(version, TheWorst)+value_in(bar, 4;5;6)"
	taskFilters, err := ParseFilters(filterExpression, common.Task)
	assert.NoError(t, err)

	assert.Len(t, taskFilters, 3)
	actualFilterExpression, _ := taskFilters[0].GetGormQueryExpr()
	assert.Equal(t, "foo = ?", actualFilterExpression.Query)
	assert.Equal(t, "123", actualFilterExpression.Args)

	actualFilterExpression, _ = taskFilters[1].GetGormQueryExpr()
	assert.Equal(t, "version <> ?", actualFilterExpression.Query)
	assert.Equal(t, "TheWorst", actualFilterExpression.Args)

	actualFilterExpression, _ = taskFilters[2].GetGormQueryExpr()
	assert.Equal(t, "bar in (?)", actualFilterExpression.Query)
	assert.Equal(t, []interface{}{"4", "5", "6"}, actualFilterExpression.Args)

	filterExpression = "invalid_function(foo,bar)"
	_, err = ParseFilters(filterExpression, common.Task)
	assert.Error(t, err)
	assert.EqualError(t, err, "unrecognized filter function: invalid_function")
}