Version: 11.3.10 | Fixed: true
[*] Variant 1: Original exploit (backtick in array key)
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 2: Closing parenthesis in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%29%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 3: IN operator with malicious array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Boperator%5D=IN\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 4: Nested OR group with malicious array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bg%5D%5Bgroup%5D%5Bconjunction%5D=OR\u0026filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x\u0026filter%5Bt%5D%5Bcondition%5D%5BmemberOf%5D=g"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 5: Double quote in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%22%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 6: Single quote in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%27%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 7: SQL comment syntax in array key
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/node\/page?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=title\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B--%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 8: JSON:API user collection endpoint
{"jsonapi":{"version":"1.1","meta":{"links":{"self":{"href":"http:\/\/jsonapi.org\/format\/1.1\/"}}}},"data":[],"links":{"self":{"href":"http:\/\/localhost:8080\/jsonapi\/user\/user?filter%5Bt%5D%5Bcondition%5D%5Bpath%5D=name\u0026filter%5Bt%5D%5Bcondition%5D%5Bvalue%5D%5B%60%5D=x"}}}
HTTP_CODE:200
  -> SAFE (HTTP 200, no SQL injection)

[*] Variant 9: JSON login endpoint with array in name field
{"message":"Sorry, unrecognized username or password."}
HTTP_CODE:400
  -> Not vulnerable via this path (expected: login processes string name, not array keys)

[*] Variant 10: Deprecated pgsql Condition class (not reachable via HTTP)
  -> SKIPPED: The deprecated Drupal\Core\Entity\Query\Sql\pgsql\Condition is only reachable if the pgsql module is not installed, which is impossible on a functioning PostgreSQL site. Even if reached, BaseCondition::compile() sanitizes array_values() upstream in 11.3.10.