Security fix (#9306)

Author: patricksanders

.pre-commit-config.yaml

@@ -27,11 +27,11 @@ repos:
         pass_filenames: true
         args: ["--profile", "black"]
 
-  - repo: https://github.com/ambv/black
-    rev: 20.8b1
-    hooks:
-      - id: black
-        language_version: python3.8
+  #  - repo: https://github.com/ambv/black
+  #    rev: 20.8b1
+  #    hooks:
+  #      - id: black
+  #        language_version: python3.8
 
   - repo: https://github.com/pre-commit/pygrep-hooks
     rev: v1.7.0

consoleme/lib/defaults.py

@@ -193,7 +193,7 @@
         required: true
     condition:
       StringLike:
-        ses:FromAddress: "{from_address}"
+        ses:FromAddress: "${from_address}"
     action_map:
       - name: send_email
         text: Send Email

consoleme/lib/generic.py

@@ -240,7 +240,8 @@ async def iterate_and_format_dict(d: Dict, replacements: Dict):
             await iterate_and_format_dict(v, replacements)
         else:
             try:
-                d[k] = v.format(**replacements)
+                s = string.Template(v)
+                d[k] = s.safe_substitute(**replacements)
             except KeyError:
                 pass
     return d