Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public Object visit(Not filter, Object extraData) {
        Filter child = filter.getFilter();
        // these filter types are already enclosed in parentheses
        boolean extraParens =
                !(child instanceof And || child instanceof Or || child instanceof PropertyIsNull);
        append(extraData, "NOT ", extraParens ? "(" : "");
        child.accept(this, extraData);
        return append(extraData, extraParens ? ")" : "");
    }