Fix: (org-ql-view--expand-buffers-files) Remove eval support

This prevents arbitrary code execution when opening "org-ql-search:"
links.  (The links feature was just pushed to master in the last day
or so, and no stable release with the feature has been tagged.)  This
fix also means that arbitrary expressions are no longer accepted when
interactively completing the buffers-files argument to
org-ql-search (a worthy trade, I think; users who need to do that can
call the function from Lisp).
This commit is contained in:
Adam Porter 2020-11-11 20:45:10 -06:00
parent c2c7efed00
commit 6ab74454d0
4 changed files with 37 additions and 41 deletions

View file

@ -1063,7 +1063,6 @@ The counterpart to `org-ql-view--contract-buffers-files'."
("all" (--select (equal (buffer-local-value 'major-mode it) 'org-mode)
(buffer-list)))
("org-directory" (org-ql-search-directories-files))
((and form (guard (rx bos "("))) (-flatten (eval (read form))))
(else (s-split (rx (1+ space)) else))))
(defun org-ql-view--complete-super-groups ()