Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   function getSpecificMassiveActions($checkitem = null) {
      $isadmin = static::canUpdate();
      $actions = parent::getSpecificMassiveActions($checkitem);

      //remove native transfer action
      unset($actions[MassiveAction::class.MassiveAction::CLASS_ACTION_SEPARATOR.'add_transfer_list']);
      $sep     = __CLASS__.MassiveAction::CLASS_ACTION_SEPARATOR;

      $actions[$sep.'reception'] = __("Take item delivery", "order");
      $actions[$sep.'transfer_order_item'] = "<i class='fa-fw fas fa-level-up-alt'></i>" .
      _x('button', 'Transfer', 'order');

      return $actions;
   }