Language: Go
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
func TestListExecutions_WithTags(t *testing.T) {
	executionRepo := NewExecutionRepo(GetDbForTest(t), errors.NewTestErrorTransformer(), mockScope.NewTestScope())

	executions := make([]map[string]interface{}, 0)
	GlobalMock := mocket.Catcher.Reset()
	// Only match on queries that include ordering by name
	mockQuery := GlobalMock.NewMock().WithQuery(`name asc`)
	mockQuery.WithReply(executions)

	sortParameter, _ := common.NewSortParameter(admin.Sort{
		Direction: admin.Sort_ASCENDING,
		Key:       "name",
	})
	vals := []string{"tag1", "tag2"}
	tagFilter, err := common.NewRepeatedValueFilter(common.ExecutionAdminTag, common.ValueIn, "admin_tag_name", vals)
	assert.NoError(t, err)
	_, err = executionRepo.List(context.Background(), interfaces.ListResourceInput{
		SortParameter: sortParameter,
		InlineFilters: []common.InlineFilter{
			getEqualityFilter(common.Task, "project", project),
			getEqualityFilter(common.Task, "domain", domain),
			getEqualityFilter(common.Task, "name", name),
			tagFilter,
		},
		Limit: 20,
	})
	assert.NoError(t, err)
	assert.True(t, mockQuery.Triggered)
}