diff --git a/java/ql/src/Security/CWE/CWE-780/RsaWithoutOaep.java b/java/ql/src/Security/CWE/CWE-780/RsaWithoutOaep.java
index 684b58eca73..34024a59f6e 100644
--- a/java/ql/src/Security/CWE/CWE-780/RsaWithoutOaep.java
+++ b/java/ql/src/Security/CWE/CWE-780/RsaWithoutOaep.java
@@ -1,7 +1,7 @@
 // BAD: No padding scheme is used
-Cipher rsa = Cipher.getInstance("RSA/ECB/NoPadding")
+Cipher rsa = Cipher.getInstance("RSA/ECB/NoPadding");
 ...
 
 //GOOD: OAEP padding is used
-Cipher rsa = Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding")
+Cipher rsa = Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding");
 ...
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.expected b/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.java b/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.java
new file mode 100644
index 00000000000..a8fc28c7d1d
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.java
@@ -0,0 +1,9 @@
+import javax.crypto.Cipher;
+
+class RsaWithoutOaep {
+    public void test() throws Exception {
+        Cipher rsaBad = Cipher.getInstance("RSA/ECB/NoPadding"); // $hasResult
+
+        Cipher rsaGood = Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding"); 
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.ql b/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.ql
new file mode 100644
index 00000000000..29d6120a9d8
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-780/RsaWithoutOaepTest.ql
@@ -0,0 +1,19 @@
+import java
+import TestUtilities.InlineExpectationsTest
+import semmle.code.java.security.RsaWithoutOaepQuery
+
+class HasResult extends InlineExpectationsTest {
+  HasResult() { this = "HasResult" }
+
+  override string getARelevantTag() { result = "hasResult" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "hasResult" and
+    value = "" and
+    exists(MethodAccess ma |
+      rsaWithoutOaepCall(ma) and
+      location = ma.getLocation() and
+      element = ma.toString()
+    )
+  }
+}