There is a script injection here, but codeql can't detect it

**There is a script injection here, but codeql can't detect it, it may be a source problemDescription of the false positive**

**Code samples or links to source code**

For closed source code: (redacted) code samples that illustrate the problem, for example:

```
public AccessResult addHtmlTemplate(@RequestBody TemplateBean template) {
params = template.getParams();
map = (Map)this.objectMapper.readValue(params.getExtensionParam(), Map.class);
String newExpression = ((String)map.get("expression"))
ScriptEngineManager engineManager = new ScriptEngineManager();
ScriptEngine engine = engineManager.getEngineByName("javascript");

try {
Object eval = engine.eval(newExpression);
if (eval != null) {
return true;
}
} catch (Exception var5) {
var5.printStackTrace();
}
}
```