From 6ab74454d0493105a1c57889c85800f4df962ebd Mon Sep 17 00:00:00 2001
From: Adam Porter <adam@alphapapa.net>
Date: Wed, 11 Nov 2020 20:45:10 -0600
Subject: [PATCH] Fix: (org-ql-view--expand-buffers-files) Remove eval support

This prevents arbitrary code execution when opening "org-ql-search:"
links.  (The links feature was just pushed to master in the last day
or so, and no stable release with the feature has been tagged.)  This
fix also means that arbitrary expressions are no longer accepted when
interactively completing the buffers-files argument to
org-ql-search (a worthy trade, I think; users who need to do that can
call the function from Lisp).
---
 README.org       |  1 -
 org-ql-search.el |  1 -
 org-ql-view.el   |  1 -
 org-ql.info      | 75 ++++++++++++++++++++++++------------------------
 4 files changed, 37 insertions(+), 41 deletions(-)

diff --git a/README.org b/README.org
index 9d68254..7863b92 100644
--- a/README.org
+++ b/README.org
@@ -106,7 +106,6 @@ Read ~QUERY~ and search with ~org-ql~.  Interactively, prompt for these variable
 + ~buffer~: search the current buffer 
 + ~all~: search all Org buffers 
 + ~agenda~: search buffers returned by the function ~org-agenda-files~ 
-+ An expression which evaluates to a list of files/buffers 
 + A space-separated list of file or buffer names
 
 ~GROUPS~: An ~org-super-agenda~ group set.  See variable ~org-super-agenda-groups~.
diff --git a/org-ql-search.el b/org-ql-search.el
index 0bd02f2..3abc468 100644
--- a/org-ql-search.el
+++ b/org-ql-search.el
@@ -119,7 +119,6 @@ Interactively, may also be:
 - `all': search all Org buffers
 - `agenda': search buffers returned by the function `org-agenda-files'
 - `directory': search Org files in `org-directory'
-- An expression which evaluates to a list of files/buffers
 - A space-separated list of file or buffer names
 
 QUERY: An `org-ql' query in either sexp or non-sexp form (see
diff --git a/org-ql-view.el b/org-ql-view.el
index bfe72ba..d7a34a8 100644
--- a/org-ql-view.el
+++ b/org-ql-view.el
@@ -1063,7 +1063,6 @@ The counterpart to `org-ql-view--contract-buffers-files'."
     ("all" (--select (equal (buffer-local-value 'major-mode it) 'org-mode)
                      (buffer-list)))
     ("org-directory" (org-ql-search-directories-files))
-    ((and form (guard (rx bos "("))) (-flatten (eval (read form))))
     (else (s-split (rx (1+ space)) else))))
 
 (defun org-ql-view--complete-super-groups ()
diff --git a/org-ql.info b/org-ql.info
index 2b5c83f..baf149e 100644
--- a/org-ql.info
+++ b/org-ql.info
@@ -214,7 +214,6 @@ Interactively, may also be:
    • ‘all’: search all Org buffers
    • ‘agenda’: search buffers returned by the function
      ‘org-agenda-files’
-   • An expression which evaluates to a list of files/buffers
    • A space-separated list of file or buffer names
 
    ‘GROUPS’: An ‘org-super-agenda’ group set.  See variable
@@ -1270,43 +1269,43 @@ Node: Quelpa2428
 Node: Usage2871
 Node: Commands3269
 Node: org-ql-search3742
-Node: helm-org-ql5456
-Node: org-ql-view5868
-Node: org-ql-view-sidebar6368
-Node: org-ql-view-recent-items6724
-Node: org-ql-sparse-tree7208
-Node: Queries8008
-Node: Non-sexp query syntax8916
-Node: General predicates10623
-Node: Ancestor/descendant predicates15838
-Node: Date/time predicates16966
-Node: Functions / Macros19621
-Node: Agenda-like views19876
-Node: Listing / acting-on results21281
-Node: Dynamic block25883
-Node: Links28046
-Node: Tips28733
-Node: Changelog29051
-Node: 05-pre29690
-Node: 04630782
-Node: 04531185
-Node: 04431544
-Node: 04331901
-Node: 04232096
-Node: 04132255
-Node: 0432494
-Node: 03236425
-Node: 03136802
-Node: 0336999
-Node: 02339974
-Node: 02240202
-Node: 02140470
-Node: 0240669
-Node: 0144704
-Node: Notes44805
-Node: Comparison with Org Agenda searches44967
-Node: org-sidebar45839
-Node: License46118
+Node: helm-org-ql5392
+Node: org-ql-view5804
+Node: org-ql-view-sidebar6304
+Node: org-ql-view-recent-items6660
+Node: org-ql-sparse-tree7144
+Node: Queries7944
+Node: Non-sexp query syntax8852
+Node: General predicates10559
+Node: Ancestor/descendant predicates15774
+Node: Date/time predicates16902
+Node: Functions / Macros19557
+Node: Agenda-like views19812
+Node: Listing / acting-on results21217
+Node: Dynamic block25819
+Node: Links27982
+Node: Tips28669
+Node: Changelog28987
+Node: 05-pre29626
+Node: 04630718
+Node: 04531121
+Node: 04431480
+Node: 04331837
+Node: 04232032
+Node: 04132191
+Node: 0432430
+Node: 03236361
+Node: 03136738
+Node: 0336935
+Node: 02339910
+Node: 02240138
+Node: 02140406
+Node: 0240605
+Node: 0144640
+Node: Notes44741
+Node: Comparison with Org Agenda searches44903
+Node: org-sidebar45775
+Node: License46054
 
 End Tag Table