  function onReady() {
    if (this === client) {
      assert(!clientReady,
             msg('Received multiple ready events for client'));
      clientReady = true;
      this.sftp(mustCall((err, sftp) => {
        assert(!err, msg(`Unexpected client sftp start error: ${err}`));
        clientSFTP = sftp;
        sftp.on('end', mustCall(() => {
          this.end();
        }));
        onSFTP.call(this);
      }));
    } else {
      assert(!serverReady,
             msg('Received multiple ready events for server'));
      serverReady = true;
      this.once('session', mustCall((accept, reject) => {
        accept().once('sftp', mustCall((accept, reject) => {
          const sftp = accept();
          serverSFTP = sftp;
          sftp.on('end', mustCall(() => {
            this.end();
          }));
          onSFTP.call(this);
        }));
      }));
    }
  }
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.