Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private void verifyQuery(
            QueryBuilder<?> builder,
            String expected,
            boolean debugMode,
            Filter filter,
            SortBy... order) {
        dialect.setDebugMode(debugMode);
        String actual = builder.filter(filter).sortOrder(order).build();
        assertEquals(expected, actual);
        if (Filter.INCLUDE.equals(filter)) {
            assertEquals(Filter.INCLUDE, builder.getSupportedFilter());
        } else {
            assertNotEquals(Filter.INCLUDE, builder.getSupportedFilter());
        }
        assertEquals(Filter.INCLUDE, builder.getUnsupportedFilter());
        assertEquals(!actual.startsWith("SELECT COUNT"), builder.isOffsetLimitApplied());
        assertFalse(builder.getNamedParameters().isEmpty());
    }