Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private void encodeJsonArrayContains(Function jsonArrayContains) throws IOException {
        PropertyName column = (PropertyName) getParameter(jsonArrayContains, 0, true);
        Literal jsonPath = (Literal) getParameter(jsonArrayContains, 1, true);
        Expression expected = getParameter(jsonArrayContains, 2, true);

        String[] strJsonPath = escapeJsonLiteral(jsonPath.getValue().toString()).split("/");
        if (strJsonPath.length > 0) {
            column.accept(delegate, null);
            out.write("::jsonb @> '{ ");
            out.write(buildJsonFromStrPointer(strJsonPath, 0, expected));
            out.write(" }'::jsonb");
        } else {
            throw new IllegalArgumentException(
                    "Cannot encode filter Invalid pointer " + jsonPath.getValue());
        }
    }