Language: Go
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
func NewQUICServer(addr, password, domain string, tcpTimeout, udpTimeout int, blockDomainList, blockCIDR4List, blockCIDR6List string, updateListInterval int64, blockGeoIP []string, withoutbrook bool) (*QUICServer, error) {
	if err := limits.Raise(); err != nil {
		Log(&Error{"when": "try to raise system limits", "warning": err.Error()})
	}
	if runtime.GOOS == "linux" {
		c := exec.Command("sysctl", "-w", "net.core.rmem_max=2500000")
		b, err := c.CombinedOutput()
		if err != nil {
			Log(&Error{"when": "try to raise UDP Receive Buffer Size", "warning": string(b)})
		}
	}
	if runtime.GOOS == "darwin" {
		c := exec.Command("sysctl", "-w", "kern.ipc.maxsockbuf=3014656")
		b, err := c.CombinedOutput()
		if err != nil {
			Log(&Error{"when": "try to raise UDP Receive Buffer Size", "warning": string(b)})
		}
	}
	var p []byte
	var f UDPServerConnFactory
	if !withoutbrook {
		p = []byte(password)
		f = NewPacketServerConnFactory()
	}
	if withoutbrook {
		var err error
		p, err = crypto1.SHA256Bytes([]byte(password))
		if err != nil {
			return nil, err
		}
		f = NewSimplePacketServerConnFactory()
	}
	s := &QUICServer{
		Password:             p,
		Domain:               domain,
		Addr:                 addr,
		TCPTimeout:           tcpTimeout,
		UDPTimeout:           udpTimeout,
		UDPServerConnFactory: f,
		RunnerGroup:          runnergroup.New(),
		WithoutBrook:         withoutbrook,
	}
	return s, nil
}