From 44f37f92cf9884547fec6828affd7c830a6fe366 Mon Sep 17 00:00:00 2001
From: Massimo Melina <a@rejetto.com>
Date: Tue, 23 Jun 2020 20:16:12 +0200
Subject: [PATCH] prevent macros coming from commands convert, base64decode,
 decodeuri

---
 scriptLib.pas | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/scriptLib.pas b/scriptLib.pas
index 873ac9e..3632e11 100644
--- a/scriptLib.pas
+++ b/scriptLib.pas
@@ -691,7 +691,9 @@ var
       result:='';
       for c in UTF8encode(s) do
         result:=result+intToHex(ord(c));
-      end
+      end;
+  if isFalse(par('macros')) then
+    result:=noMacrosAllowed(result);
   end; // convert
 
   procedure encodeuri();
@@ -1999,7 +2001,11 @@ try
     if name = 'base64' then
       result:=string(base64encode(UTF8encode(p)));
     if name = 'base64decode' then
+      begin
       result:=utf8ToString(base64decode(ansistring(p)));
+      if isFalse(par('macros')) then
+        result:=noMacrosAllowed(result);
+      end;
     if name = 'md5' then
       result:=strMD5(p);
     if name = 'sha1' then
@@ -2078,7 +2084,7 @@ try
       encodeuri();
 
     if name = 'decodeuri' then
-      result:=decodeURL(ansistring(p));
+      result:=noMacrosAllowed(decodeURL(ansistring(p)));
 
     if name = 'set cfg' then
       trueIf(mainfrm.setcfg(p));