Security fix (#9306)

Netflix · Mar 30, 2022 · 2a3c84e · 2a3c84e
1 parent c4ea122
commit 2a3c84e
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 7 deletions.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -27,11 +27,11 @@ repos:
         pass_filenames: true
         args: ["--profile", "black"]
 
-  - repo: https://github.com/ambv/black
-    rev: 20.8b1
-    hooks:
-      - id: black
-        language_version: python3.8
+  #  - repo: https://github.com/ambv/black
+  #    rev: 20.8b1
+  #    hooks:
+  #      - id: black
+  #        language_version: python3.8
 
   - repo: https://github.com/pre-commit/pygrep-hooks
     rev: v1.7.0

diff --git a/consoleme/lib/defaults.py b/consoleme/lib/defaults.py
@@ -193,7 +193,7 @@
         required: true
     condition:
       StringLike:
-        ses:FromAddress: "{from_address}"
+        ses:FromAddress: "${from_address}"
     action_map:
       - name: send_email
         text: Send Email

diff --git a/consoleme/lib/generic.py b/consoleme/lib/generic.py
@@ -240,7 +240,8 @@ async def iterate_and_format_dict(d: Dict, replacements: Dict):
             await iterate_and_format_dict(v, replacements)
         else:
             try:
-                d[k] = v.format(**replacements)
+                s = string.Template(v)
+                d[k] = s.safe_substitute(**replacements)
             except KeyError:
                 pass
     return d