function userBroadcast(msg, source) {
  var sourceMsg = '> ' + msg;
  var name = '{cyan-fg}{bold}' + source.name + '{/}';
  msg = ': ' + msg;
  for (var i = 0; i < users.length; ++i) {
    var user = users[i];
    var output = user.output;
    if (source === user)
      output.add(sourceMsg);
    else
      output.add(formatMessage(name, output) + msg);
  }
}
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.