Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public String buildJsonFromStrPointer(String[] pointers, Expression expectedExp) {
        if (!"".equals(pointers[0])) {
            if (pointers.length == 1) {
                final String expected =
                        getBaseType(expectedExp).isAssignableFrom(String.class)
                                ? String.format(
                                        "\"%s\"", ((Literal) expectedExp).getValue().toString())
                                : ((Literal) expectedExp).getValue().toString();
                return String.format("\"%s\": [%s]", pointers[0], expected);
            } else {
                return String.format(
                        "\"%s\": { %s }",
                        pointers[0],
                        buildJsonFromStrPointer(
                                Arrays.copyOfRange(pointers, 1, pointers.length), expectedExp));
            }
        } else
            return buildJsonFromStrPointer(
                    Arrays.copyOfRange(pointers, 1, pointers.length), expectedExp);
    }