Fix: (org-ql-view--expand-buffers-files) Remove eval support

This prevents arbitrary code execution when opening "org-ql-search:"
links.  (The links feature was just pushed to master in the last day
or so, and no stable release with the feature has been tagged.)  This
fix also means that arbitrary expressions are no longer accepted when
interactively completing the buffers-files argument to
org-ql-search (a worthy trade, I think; users who need to do that can
call the function from Lisp).
This commit is contained in:
Adam Porter 2020-11-11 20:45:10 -06:00
parent c2c7efed00
commit 6ab74454d0
4 changed files with 37 additions and 41 deletions

View file

@ -106,7 +106,6 @@ Read ~QUERY~ and search with ~org-ql~. Interactively, prompt for these variable
+ ~buffer~: search the current buffer + ~buffer~: search the current buffer
+ ~all~: search all Org buffers + ~all~: search all Org buffers
+ ~agenda~: search buffers returned by the function ~org-agenda-files~ + ~agenda~: search buffers returned by the function ~org-agenda-files~
+ An expression which evaluates to a list of files/buffers
+ A space-separated list of file or buffer names + A space-separated list of file or buffer names
~GROUPS~: An ~org-super-agenda~ group set. See variable ~org-super-agenda-groups~. ~GROUPS~: An ~org-super-agenda~ group set. See variable ~org-super-agenda-groups~.

View file

@ -119,7 +119,6 @@ Interactively, may also be:
- `all': search all Org buffers - `all': search all Org buffers
- `agenda': search buffers returned by the function `org-agenda-files' - `agenda': search buffers returned by the function `org-agenda-files'
- `directory': search Org files in `org-directory' - `directory': search Org files in `org-directory'
- An expression which evaluates to a list of files/buffers
- A space-separated list of file or buffer names - A space-separated list of file or buffer names
QUERY: An `org-ql' query in either sexp or non-sexp form (see QUERY: An `org-ql' query in either sexp or non-sexp form (see

View file

@ -1063,7 +1063,6 @@ The counterpart to `org-ql-view--contract-buffers-files'."
("all" (--select (equal (buffer-local-value 'major-mode it) 'org-mode) ("all" (--select (equal (buffer-local-value 'major-mode it) 'org-mode)
(buffer-list))) (buffer-list)))
("org-directory" (org-ql-search-directories-files)) ("org-directory" (org-ql-search-directories-files))
((and form (guard (rx bos "("))) (-flatten (eval (read form))))
(else (s-split (rx (1+ space)) else)))) (else (s-split (rx (1+ space)) else))))
(defun org-ql-view--complete-super-groups () (defun org-ql-view--complete-super-groups ()

View file

@ -214,7 +214,6 @@ Interactively, may also be:
all: search all Org buffers all: search all Org buffers
agenda: search buffers returned by the function agenda: search buffers returned by the function
org-agenda-files org-agenda-files
• An expression which evaluates to a list of files/buffers
• A space-separated list of file or buffer names • A space-separated list of file or buffer names
GROUPS: An org-super-agenda group set. See variable GROUPS: An org-super-agenda group set. See variable
@ -1270,43 +1269,43 @@ Node: Quelpa2428
Node: Usage2871 Node: Usage2871
Node: Commands3269 Node: Commands3269
Node: org-ql-search3742 Node: org-ql-search3742
Node: helm-org-ql5456 Node: helm-org-ql5392
Node: org-ql-view5868 Node: org-ql-view5804
Node: org-ql-view-sidebar6368 Node: org-ql-view-sidebar6304
Node: org-ql-view-recent-items6724 Node: org-ql-view-recent-items6660
Node: org-ql-sparse-tree7208 Node: org-ql-sparse-tree7144
Node: Queries8008 Node: Queries7944
Node: Non-sexp query syntax8916 Node: Non-sexp query syntax8852
Node: General predicates10623 Node: General predicates10559
Node: Ancestor/descendant predicates15838 Node: Ancestor/descendant predicates15774
Node: Date/time predicates16966 Node: Date/time predicates16902
Node: Functions / Macros19621 Node: Functions / Macros19557
Node: Agenda-like views19876 Node: Agenda-like views19812
Node: Listing / acting-on results21281 Node: Listing / acting-on results21217
Node: Dynamic block25883 Node: Dynamic block25819
Node: Links28046 Node: Links27982
Node: Tips28733 Node: Tips28669
Node: Changelog29051 Node: Changelog28987
Node: 05-pre29690 Node: 05-pre29626
Node: 04630782 Node: 04630718
Node: 04531185 Node: 04531121
Node: 04431544 Node: 04431480
Node: 04331901 Node: 04331837
Node: 04232096 Node: 04232032
Node: 04132255 Node: 04132191
Node: 0432494 Node: 0432430
Node: 03236425 Node: 03236361
Node: 03136802 Node: 03136738
Node: 0336999 Node: 0336935
Node: 02339974 Node: 02339910
Node: 02240202 Node: 02240138
Node: 02140470 Node: 02140406
Node: 0240669 Node: 0240605
Node: 0144704 Node: 0144640
Node: Notes44805 Node: Notes44741
Node: Comparison with Org Agenda searches44967 Node: Comparison with Org Agenda searches44903
Node: org-sidebar45839 Node: org-sidebar45775
Node: License46118 Node: License46054
 
End Tag Table End Tag Table