Fixinator is scanning code that is commented out if the comment block has nested comment blocks

[jbartlett777]

<!--- Main comment block
	<!--- Secondary comment block --->
	<cfquery name="qry" datasource="#DSN#">
		EXEC StoredProc '#Param1#', '#Param2#'
	</cfquery>
--->

It appears that the logic behind identifying the comment blocks is considering the comment end on the 2nd line as being the close of the comment block that started on line 1.

[HIGH] SQL Injection finding on line 5 of fixinator_testcase.cfm high confidence
Variables within a SQL statement must be passed as parameters to the database engine, for example by using cfqueryparam
/fixinator_testcase.cfm:5
    5: EXEC StoredProc '#Param1#', '#Param2#'

Possible Fixes:
        1) cfqueryparam: <cfqueryparam value="#Param2#">
        2) cfqueryparam varchar: <cfqueryparam value="#Param2#" cfsqltype="cf_sql_varchar">

If the secondary comment block is moved down below the query, there is no issue flagged.

[pfreitag]

Thanks I believe it does have logic to deal with nested comments, but it does certainly appear to be an issue in this case. I will look into this.