Language: JavaScript
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
  executeOptions.complete = function (err, stmt)
  {
    assert.ok(!err, JSON.stringify(err));
    var rowCount = 0;
    var stream = stmt.streamRows();
    stream.on('readable', function ()
    {
      var row;
      while ((row = stream.read()) !== null)
      {
        assert.deepStrictEqual(normalize ? normalizeRowObject(row) : row, expected[rowCount]);
        rowCount++;
      }
    });
    stream.on('error', function (err)
    {
      assert.ok(!err, JSON.stringify(err));
    });
    stream.on('end', function ()
    {
      assert.strictEqual(rowCount, expected.length);
      callback();
    });
  };