diff --git a/org-ql-view.el b/org-ql-view.el index 0255b76..6945c45 100644 --- a/org-ql-view.el +++ b/org-ql-view.el @@ -615,8 +615,13 @@ protocol. See, e.g. `org-ql-view--link-store'." (query (url-unhex-string query)) (params (when params (url-parse-query-string params))) ;; `url-parse-query-string' returns "improper" alists, which makes this awkward. - (sort (--when-let (alist-get "sort" params nil nil #'string=) - (read it))) + (sort (when-let* ((stored-string (alist-get "sort" params nil nil #'string=)) + (read-value (read stored-string))) + ;; Ensure the value is either a symbol or list of symbols (which excludes lambdas). + (unless (or (symbolp read-value) (cl-every #'symbolp read-value)) + (error "Potentially unsafe value found in link's SORT parameter (%s). Link not opened" + read-value)) + read-value)) (org-super-agenda-allow-unsafe-groups nil) ; Disallow unsafe group selectors. (groups (--when-let (alist-get "super-groups" params nil nil #'string=) (read it)))