Decompiler can execute arbitrary code

[hashkitten]

Description

Compile the following program to bytecode using python -m compileall, then run decompyle3 on it:

foo('%{__import__("os").system("date")}', **x, y=1)

It will run the date command on the user's machine.

Expected behavior

It should not run arbitrary code on the user's machine while decompiling.

Additional Context

The bug is a double format here: https://github.com/rocky/python-decompile3/blob/f0b39d07a66233db3fab010173b355b68a217f6b/decompyle3/semantics/customize37.py#L1182

The string is interpolated with user data, then placed into the templating engine.

[rocky]

Thanks for the report. Are you up for fixing this and putting in a PR?

[hashkitten]

https://github.com/rocky/python-decompile3/pull/154

[rocky]

Fixed by #154

[rocky]

Thanks for the report. Are you up for fixing this and putting in a PR?

Fixed now in uncompyle6 as well.