Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private void encodeJsonArrayContains(Function jsonArrayContains) throws IOException {
        PropertyName column = (PropertyName) getParameter(jsonArrayContains, 0, true);
        Literal jsonPath = (Literal) getParameter(jsonArrayContains, 1, true);
        Expression expected = getParameter(jsonArrayContains, 2, true);

        String[] strJsonPath = jsonPath.getValue().toString().split("/");
        if (strJsonPath.length > 0) {
            String jsonFilter =
                    String.format("{ %s }", buildJsonFromStrPointer(strJsonPath, expected));
            out.write(
                    String.format(
                            "\"%s\"::jsonb @> '%s'::jsonb", column.getPropertyName(), jsonFilter));
        } else {
            throw new IllegalArgumentException(
                    "Cannot encode filter Invalid pointer " + jsonPath.getValue());
        }
    }