False negative in G-9501 when parameter name is used more than once

[PhilippSalvisberg]

Here's an example:

create or replace procedure insert_sort(
   in_pk        varchar2,
   in_view_name varchar2,
   in_desc      varchar2
)
is
   sql_stmt varchar2(500);
begin
   sql_stmt := 'INSERT INTO sort_f (sort_id, fk_id, view_name, fk_name, fk_attr_desc, sort_nr) '
               || 'SELECT sort_seq.nextval, x.* '
               || 'FROM (SELECT distinct '
               || in_pk
               || ' fk_id '
               || ', '''
               || in_view_name
               || ''' view_name '
               || ', '''
               || in_pk
               || ''' fk_name '
               || ', '''
               || in_desc
               || ''' fk_attr_desc '
               || ', '
               || in_pk
               || ' sort_nr '
               || 'FROM '
               || in_view_name
               || ' WHERE NOT EXISTS '
               || ' ( SELECT 1 FROM sort_f s '
               || '    WHERE s.fk_id = '
               || sys.dbms_assert.sql_name(in_pk)
               || '      AND s.view_name = '''
               || sys.dbms_assert.sql_name(in_view_name)
               || ''' '
               || '      AND s.fk_attr_desc = '''
               || sys.dbms_assert.sql_name(in_desc)
               || ''' '
               || '  )'
               || ') x';

   execute immediate sql_stmt;
   commit;
end insert_sort;

No violations are reported for the unasserted usages of in_pk , in_view_name, in_desc.

Only the last usage of a parameter is considered for the check.