Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public String jsonExists(Function function) {
        PropertyName columnName = (PropertyName) getParameter(function, 0, true);
        Literal jsonPath = (Literal) getParameter(function, 1, true);
        Expression expected = getParameter(function, 2, true);

        String[] pointers = jsonPath.getValue().toString().split("/");
        if (pointers.length > 0) {
            String strJsonPath = String.join(".", pointers);
            return String.format(
                    "json_exists(%s, '$%s?(@ == \"%s\")')",
                    columnName, strJsonPath, expected.evaluate(null));
        } else {
            throw new IllegalArgumentException(
                    "Cannot encode filter Invalid pointer " + jsonPath.getValue());
        }
    }