Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    protected <T extends Connection> T unwrapConnection(Connection cx, Class<T> clazz)
            throws SQLException {
        if (clazz.isInstance(cx)) {
            return clazz.cast(cx);
        }
        try {
            // Unwrap the connection multiple levels as necessary to get at the underlying
            // connection. Maintain a map of UnWrappers to avoid searching the registry
            // every time we need to unwrap.
            Connection testCon = cx;
            Connection toUnwrap;
            do {
                UnWrapper unwrapper = uwMap.get(testCon.getClass());
                if (unwrapper == null) {
                    unwrapper = DataSourceFinder.getUnWrapper(testCon);
                    if (unwrapper == null) {
                        unwrapper = UNWRAPPER_NOT_FOUND;
                    }
                    uwMap.put(testCon.getClass(), unwrapper);
                }
                if (unwrapper == UNWRAPPER_NOT_FOUND) {
                    // give up and do Java unwrap below
                    break;
                }
                toUnwrap = testCon;
                testCon = unwrapper.unwrap(testCon);
                if (clazz.isInstance(testCon)) {
                    return clazz.cast(cx);
                }
            } while (testCon != null && testCon != toUnwrap);
            // try to use Java unwrapping
            try {
                if (cx.isWrapperFor(clazz)) {
                    return cx.unwrap(clazz);
                }
            } catch (Throwable t) {
                // not a mistake, old DBCP versions will throw an Error here, we need to catch it
                LOGGER.log(Level.FINER, "Failed to unwrap connection using Java facilities", t);
            }
        } catch (IOException e) {
            throw new SQLException(
                    "Could not obtain " + clazz.getName() + " from " + cx.getClass(), e);
        }
        throw new SQLException("Could not obtain " + clazz.getName() + " from " + cx.getClass());
    }