  copy: function (from, dist, callback) {
    var that = this,
      cmd = '';
    dist = path.resolve(dist);
    fs.lstat(from, function (err, stats) {
      if (err) {
        callback(err);
      } else {
        if (stats.isDirectory()) {
          that.mkdir(dist, function (err) {
            if (err) {
              callback(err);
            } else {
              if (that._win32) {
                cmd = 'echo d|xcopy /s /e /y ' + shellescape([path.join(from, '*')]) + ' ' + shellescape([dist]);
              } else {
                cmd = 'cp -f -R -p ' + shellescape([path.join(from, '*')]) + ' ' + shellescape([dist]);
              }
              child_process.exec(cmd, function (error, stdout, stderr) {
                callback && callback(error);
              });
            }
          });
        } else if (stats.isFile()) {
          if (that._win32) {
            cmd = 'echo f|xcopy /y ' + shellescape([from]) + ' ' + shellescape([dist]);
          } else {
            cmd = 'cp -f -p ' + shellescape([from]) + ' ' + shellescape([dist]);
          }
          child_process.exec(cmd, function (error, stdout, stderr) {
            callback && callback(error);
          });
        } else {
          callback && callback(null);
        }
      }
    });
  },
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.