  return function mustNotCall(...args) {
    args = args.map(inspect).join(', ');
    const argsInfo = (args.length > 0
                      ? `\ncalled with arguments: ${args}`
                      : '');
    assert.fail(
      `${msg || 'function should not have been called'} at ${callSite}`
        + argsInfo);
  };
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.