jiri/org-ql
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add: (org-ql-view-ask-unsafe-links)

Browse source
This commit is contained in:
Adam Porter 2020-11-10 19:17:14 -06:00
parent e3c7aaf98d
commit 364dfabca4
1 changed files with 29 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

29
org-ql-view.el
View file

@ -98,6 +98,23 @@ Based on `org-agenda-mode-map'.")
"Options for `org-ql-view'." "Options for `org-ql-view'."
:group 'org-ql) :group 'org-ql)
(defcustom org-ql-view-ask-unsafe-links t
"Ask before opening a link that could run arbitrary code.
Org QL queries in sexp form can contain arbitrary expressions.
When opening an \"org-ql-search:\" link that contains a query in
sexp form, and this option is non-nil, the user will be prompted
for confirmation before opening the link.
This variable may be set file-locally to disable this warning in
files that the user assumes are safe (e.g. of known provenance).
Users who are entirely unconcerned about this issue may disable
the option globally (at their own risk, however minimal it
probably is).
See Info node `(org-ql)Queries'."
:type 'boolean
:risky t)
(defcustom org-ql-view-display-buffer-action nil (defcustom org-ql-view-display-buffer-action nil
"Action argument passed through `pop-to-buffer' to `display-buffer', which see." "Action argument passed through `pop-to-buffer' to `display-buffer', which see."
:type '(cons function alist)) :type '(cons function alist))
@ -600,6 +617,18 @@ protocol. See, e.g. `org-ql-view--link-store'."
(read it))) (read it)))
(buffers-files (--when-let (alist-get "buffers-files" params nil nil #'string=) (buffers-files (--when-let (alist-get "buffers-files" params nil nil #'string=)
(read it)))) (read it))))
(when (and org-ql-view-ask-unsafe-links
(or (string-match (rx bol (0+ space) "(") query)
(listp query)))
;; Query is in sexp form: ask for confirmation, because it could contain arbitrary code.
(let ((query-string (propertize (cl-etypecase query
(list (prin1-to-string query))
(string query))
;; FIXME: The face doesn't seem to be displayed.
'face 'font-lock-warning-face)))
(unless (yes-or-no-p (concat "Query is in sexp form and could contain arbitrary code: "
query-string " Execute it? "))
(user-error "Query aborted by user"))))
(org-ql-search buffers-files query (org-ql-search buffers-files query
:sort sort :sort sort
:super-groups groups :super-groups groups