Language: JavaScript
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
            isSuccess: defer(),
        };

        let sentReply = false;
        if (shouldOpRespond) {
            // Listen for message from bot
            env.ircMock._whenClient(config._server, config._botnick, "say", (self: any, message: any) => {
                // Say yes back to the bot
                if (sentReply) {
                    return;
                }
                sentReply = true;

                self.emit("message", receivingOp.nick, config._botnick, "yes");
            });
        }

        const res = await env.mockAppService._link(body);

        if (waitForState) {
            const state = env.bridgingState[roomId];
            // Wait until m.room.bridging has been set to the desired state
            if (waitForState === "pending") {
                await state.isPending.promise;
            }
            else if (waitForState === "success") {
                await state.isSuccess.promise;
            }
            else if (waitForState === "failure") {
                await state.isFailed.promise;
            }
        }

        return res;
    }