Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private void verifyForCount(String expectedSQL, boolean debugMode, Filter filter) {
        String expected = expectedSQL;
        if (!expected.startsWith("SELECT")) {
            expected =
                    "SELECT COUNT(oid) FROM object WHERE type_id IN (:types) "
                            + (debugMode ? "/* org.geoserver.catalog.WorkspaceInfo */\n" : "")
                            + "AND "
                            + expectedSQL;
        }
        QueryBuilder<?> builder = QueryBuilder.forCount(dialect, WorkspaceInfo.class, dbMappings);
        verifyQuery(builder, expected, debugMode, filter);
    }