Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private void verifyForIds(
            String expectedSQL, boolean debugMode, Filter filter, SortBy... order) {
        String expected = expectedSQL;
        if (!expected.startsWith("SELECT")) {
            expected =
                    "SELECT id FROM object WHERE type_id IN (:types) "
                            + (debugMode ? "/* org.geoserver.catalog.WorkspaceInfo */\n" : "")
                            + "AND "
                            + expectedSQL
                            + "ORDER BY oid";
        }
        QueryBuilder<?> builder = QueryBuilder.forIds(dialect, WorkspaceInfo.class, dbMappings);
        verifyQuery(builder, expected, debugMode, filter, order);
    }