Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   function getSpecificMassiveActions($checkitem = null) {
      $isadmin = static::canUpdate();
      $actions = parent::getSpecificMassiveActions($checkitem);
      $sep     = __CLASS__.MassiveAction::CLASS_ACTION_SEPARATOR;

      $actions[$sep.'generation'] = __("Generate item", "order");
      $actions[$sep.'createLink'] = __("Link to an existing item", "order");
      $actions[$sep.'deleteLink'] = __("Delete item link", "order");

      return $actions;
   }