Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public Object visit(PropertyIsLike filter, Object extraData) {
        char esc = filter.getEscape().charAt(0);
        char multi = filter.getWildCard().charAt(0);
        char single = filter.getSingleChar().charAt(0);
        boolean matchCase = filter.isMatchingCase();

        String literal = filter.getLiteral();
        Expression att = filter.getExpression();

        // JD: hack for date values, we append some additional padding to handle
        // the matching of time/timezone/etc...
        Class attributeType = getExpressionType(att);
        // null check if returnType of expression is Object, null is returned
        // from getExpressionType
        if (attributeType != null && Date.class.isAssignableFrom(attributeType)) {
            literal += multi;
        }

        String pattern = LikeFilterImpl.convertToSQL92(esc, multi, single, matchCase, literal);

        try {
            if (!matchCase) {
                out.write(" UPPER(");
            }

            att.accept(this, extraData);

            if (!matchCase) {
                out.write(") LIKE '");
            } else {
                out.write(" LIKE '");
            }

            out.write(pattern);
            out.write("' ");
        } catch (java.io.IOException ioe) {
            throw new RuntimeException(IO_ERROR, ioe);
        }
        return extraData;
    }