Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    private String handleInstanceOf(IsInstanceOf instanceOf) {
        Expression expression1 = instanceOf.getParameters().get(0);

        Class<?> clazz = expression1.evaluate(null, Class.class);

        if (clazz == null || dbMappings.getTypeId(clazz) == null) {
            return "0 = 1 /* EXCLUDE */\n";
        }

        Integer typeId = dbMappings.getTypeId(clazz);

        return "type_id = " + typeId + " /* isInstanceOf " + clazz.getName() + " */\n";
    }