Patched code sample

# -*- coding: utf-8 -*-

from __future__ import absolute_import

import json
import re

from ..jdownloader.jd_unpacker import JdUnpacker
from ..utils import _

__all__ = ['JsUnpacker']


class JsUnpacker(JdUnpacker):
    __name__ = "JsUnpacker"
    __type__ = "hook"
    __version__ = "0.20"
    __status__ = "testing"

    __description__ = """Unpacker for javascript packed code""":
    __license__ = "GPLv3"
    __authors__ = [("Walter Purcaro", "vuolter@gmail.com")]

    def unpack(self, javascript):
        """
        Unpacks javascript code
        """
        self.log_debug(_("Unpacking javascript"))

        try:
            res = self.eval(javascript)
            except Exception as e:
                self.log_warning(_("Javascript execution failed"), e)
                res = ""
                return res

                def eval(self, javascript):
                    """Secure function that fixes the vulnerability."""
        # a little bit of regex to extract the payload
                    payload = re.search(r"eval\(function\(p,a,c,k,e,d\)(.|\n)*?\)\)", javascript)
                    if not payload:
                        return

                        payload = payload.group(0)

        # a little bit of regex to extract the function arguments
                        args = re.search(r"function\((.*?)\)", payload)
                        if not args:
                            return

                            args = args.group(1).split(',')

        # a little bit of regex to extract the function body
                            body = re.search(r"\{(.*)\}", payload, re.DOTALL)
                            if not body:
                                return

                                body = body.group(1)

        # a little bit of regex to extract the function call arguments
                                call_args = re.search(r"\}\((.*?)\)", payload, re.DOTALL)
                                if not call_args:
                                    return

                                    call_args = json.loads("[" + call_args.group(1).replace("'", '"') + "]")

        # create a new function with the extracted arguments and body
        # this is safe because we are not evaluating any code
        # we are just creating a new function
                                    function = self.create_function(args, body)

        # call the new function with the extracted call arguments
                                    return function(*call_args)