Language: C
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
update_job_run (updateJobPtr job)
{
	/* Here we decide on the source type and the proper execution
	   methods which then do anything they want with the job and
	   pass the processed job to update_process_finished_job()
	   for result dequeuing */

	/* everything starting with '|' is a local command */
	if (*(job->request->source) == '|') {
		debug1 (DEBUG_UPDATE, "Recognized local command: %s", job->request->source);
		update_exec_cmd (job);
		return;
	}

	/* if it has a protocol "://" prefix, but not "file://" it is an URI */
	if (strstr (job->request->source, "://") && strncmp (job->request->source, "file://", 7)) {
		network_process_request (job);
		return;
	}

	/* otherwise it must be a local file... */
	{
		debug1 (DEBUG_UPDATE, "Recognized file URI: %s", job->request->source);
		update_load_file (job);
		return;
	}
}