Language: JavaScript
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
module.exports.executeQueryAndVerify = function (connection, sql, expected, callback, bindArray, normalize)
{
  // Sometimes we may not want to normalize the row first
  normalize = (typeof normalize !== "undefined" && normalize != null) ? normalize : true;
  var executeOptions = {};
  executeOptions.sqlText = sql;
  executeOptions.complete = function (err, stmt)
  {
    assert.ok(!err, JSON.stringify(err));
    var rowCount = 0;
    var stream = stmt.streamRows();
    stream.on('readable', function ()
    {
      var row;
      while ((row = stream.read()) !== null)
      {
        assert.deepStrictEqual(normalize ? normalizeRowObject(row) : row, expected[rowCount]);
        rowCount++;
      }
    });
    stream.on('error', function (err)
    {
      assert.ok(!err, JSON.stringify(err));
    });
    stream.on('end', function ()
    {
      assert.strictEqual(rowCount, expected.length);
      callback();
    });
  };
  if (bindArray != null && bindArray != undefined)
  {
    executeOptions.binds = bindArray;
  }

  connection.execute(executeOptions);
};