Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public String jsonExists(Function function) {
        PropertyName columnName = (PropertyName) getParameter(function, 0, true);
        Literal jsonPath = (Literal) getParameter(function, 1, true);
        Expression expected = getParameter(function, 2, true);

        String[] pointers = jsonPath.getValue().toString().split("/");
        if (pointers.length > 0) {
            String strJsonPath = escapeLiteral(String.join(".", pointers));
            String strExpected = escapeLiteral(expected.evaluate(null, String.class));
            return String.format(
                    "json_exists(%s, '$%s?(@ == \"%s\")')", columnName, strJsonPath, strExpected);
        } else {
            throw new IllegalArgumentException(
                    "Cannot encode filter Invalid pointer " + jsonPath.getValue());
        }
    }