Language: TypeScript
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    constructor(
        roomId: string,
        private state: GenericHookConnectionState,
        public readonly hookId: string,
        stateKey: string,
        private readonly messageClient: MessageSenderClient,
        private readonly config: BridgeConfigGenericWebhooks,
        private readonly as: Appservice,
        private readonly intent: Intent,
    ) {
        super(roomId, stateKey, GenericHookConnection.CanonicalEventType);
        if (state.transformationFunction && config.allowJsTransformationFunctions) {
            this.transformationFunction = new Script(state.transformationFunction);
        }
    }