    it "should collapse all comments and emails on a specific contact" do
      comment = double(Comment)
      Comment.should_receive(:find).with("1").and_return(comment)
      comment.should_receive(:update_attribute).with(:state, 'Collapsed')
      xhr :get, :timeline, :type => "comment", :id => "1", :state => "Collapsed"
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.