1. (20) Consider an e-commerce web application. The following code excerpt is from a web page that enables a customer, after logging in, to view his/her invoices. Assume the schema for database table "invoices" is the following: "invoces(id, userid, item, qty, unitPrice, shippingAddress, orderDate]". Fields id, userid, item, and shippingAddress of of type string Public class DisplayInvoice extends HttpServiet ( Public void doPost(HttpServietRequest, request, HttpServietResponse response) //user must be logged in to view invoices String userid request.getSession).getAttributef"userid'"); f (userids enull) ( B. Throw new NotLoggedinExceptionC"User must be loggined" String a fequest String querySELECT FROM invoices WHERE id++ Statement snta connection.createtatement); celD"); Il code to display rs (a) Would a static analysis tool flag it as having a potential vulnerability, if so what type of static analysis will find this vulnerability? (b) This problem contains a vulnerability that cannot be detected by generic static analysis. Please correct the problem. 1. (20) Consider an e-commerce web application. The following code excerpt is from a web page that enables a customer, after logging in, to view his/her invoices. Assume the schema for database table "invoices" is the following: "invoces(id, userid, item, qty, unitPrice, shippingAddress, orderDate]". Fields id, userid, item, and shippingAddress of of type string Public class DisplayInvoice extends HttpServiet ( Public void doPost(HttpServietRequest, request, HttpServietResponse response) //user must be logged in to view invoices String userid request.getSession).getAttributef"userid'"); f (userids enull) ( B. Throw new NotLoggedinExceptionC"User must be loggined" String a fequest String querySELECT FROM invoices WHERE id++ Statement snta connection.createtatement); celD"); Il code to display rs (a) Would a static analysis tool flag it as having a potential vulnerability, if so what type of static analysis will find this vulnerability? (b) This problem contains a vulnerability that cannot be detected by generic static analysis. Please correct the