Inconsistency in SQL_INJECTION_JPA Rule: Discrepancy in Violation Reporting with Nested Class

[soyodream]

Environment

Component	Version
Java	11.0.19
FindSecBugs	1.12.0

Problem

I have identified an inconsistency in the detection behavior of the SQL_INJECTION_JPA rule in find-sec-bugs. In the first code case, the rule correctly reports a violation at line 14. However, when introducing a nested class, as shown in the second code case, the rule fails to report the violation at the same location. This behavior is inconsistent.

Code

code1

import javax.persistence.Entity;
import javax.persistence.EntityManager;
import javax.persistence.Id;
import javax.persistence.Query;

public class EnumUseInSql {
   EntityManager entityManager;
   private String prepareQuery(Enum someEnum) {
       String sql = " ... some SQL... " + someEnum.toString();
       return sql;
   }
   public void doSQL(SomeEnum value) {
       Query q = entityManager.createNativeQuery(
               prepareQuery(value),    //report a violation
               UserEntity.class);
   }
}

@Entity
class UserEntity {
   @Id private Long id;
   public Long getId() {
       return id;
   }
   public void setId(Long id) {
       this.id = id;
   }
}

enum SomeEnum {
   A("a"),
   B("b");
   private final String someName;
   SomeEnum(String someName) {
       this.someName = someName;
   }
   public String toString() {
       return someName;
   }
}

code2

import javax.persistence.Entity;
import javax.persistence.EntityManager;
import javax.persistence.Id;
import javax.persistence.Query;

public class EnumUseInSql {
   EntityManager entityManager;
   private String prepareQuery(Enum someEnum) {
       String sql = " ... some SQL... " + someEnum.toString();
       return sql;
   }
   Object anonWrap =
           new Object() {
               public void doSQL(SomeEnum value) {
                   Query q = entityManager.createNativeQuery(
                           prepareQuery(value),    //does not report a violation
                           UserEntity.class);
               }
           };
}

@Entity
class UserEntity {
   @Id private Long id;
   public Long getId() {
       return id;
   }
   public void setId(Long id) {
       this.id = id;
   }
}

enum SomeEnum {
   A("a"),
   B("b");
   private final String someName;
   SomeEnum(String someName) {
       this.someName = someName;
   }
   public String toString() {
       return someName;
   }
}