function createConnection(options, cb) {
  var srcIP = (options && options.localAddress) || this._defaultSrcIP;
  var srcPort = (options && options.localPort) || 0;
  var dstIP = options.host;
  var dstPort = options.port;

  if (Client === undefined)
    Client = require('./client').Client;

  var client = new Client();
  var triedForward = false;
  client.on('ready', () => {
    client.forwardOut(srcIP, srcPort, dstIP, dstPort, (err, stream) => {
      triedForward = true;
      if (err) {
        client.end();
        return cb(err);
      }
      stream.once('close', () => {
        client.end();
      });
      cb(null, decorateStream(stream));
    });
  }).on('error', cb).on('close', () => {
    if (!triedForward)
      cb(new Error('Unexpected connection loss'));
  }).connect(this._connectCfg);
}
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.