Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private void verifyFilterToSqlSettings(
            boolean escapeBackslash, boolean withPS, boolean withQuery) throws Exception {
        if (withQuery) {
            when(this.st2.executeQuery("SHOW standard_conforming_strings")).thenReturn(this.rs2);
            when(this.rs2.next()).thenReturn(true);
            when(this.rs2.getString(1)).thenReturn(escapeBackslash ? "off" : "on");
        } else {
            when(this.conn.isWrapperFor(PgConnection.class)).thenReturn(true);
            when(this.conn.unwrap(PgConnection.class)).thenReturn(this.pgConn);
            when(this.pgConn.getStandardConformingStrings()).thenReturn(!escapeBackslash);
        }
        Map<String, Object> params = new HashMap<>();
        params.put(DATASOURCE.key, this.ds);
        params.put(PREPARED_STATEMENTS.key, withPS);
        this.store = new PostgisNGDataStoreFactory().createDataStore(params);
        assertNotNull(this.store);
        SQLDialect dialect = this.store.getSQLDialect();
        assertThat(dialect, instanceOf(withPS ? PostGISPSDialect.class : PostGISDialect.class));
        PostGISDialect pgDialect =
                withPS ? ((PostGISPSDialect) dialect).getDelegate() : (PostGISDialect) dialect;
        assertEquals(new Version("15.1"), pgDialect.getPostgreSQLVersion(this.conn));
        assertEquals(new Version("3.3.2"), pgDialect.getVersion(this.conn));
        assertEquals(escapeBackslash, pgDialect.isEscapeBackslash());
        verify(this.conn, withQuery ? times(2) : times(1)).createStatement();
        verify(this.conn).close();
        verify(this.st1).close();
        verify(this.rs1).close();
        verify(this.st2, withQuery ? times(1) : never()).close();
        verify(this.rs2, withQuery ? times(1) : never()).close();
    }