jiri/org-ql
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: (org-ql-view--link-open) Safety check the sort parameter

Browse source
This commit is contained in:
Adam Porter 2020-11-12 00:22:23 -06:00
parent 689cfd68e7
commit a5d4886880
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
org-ql-view.el
View file

@ -615,8 +615,13 @@ protocol. See, e.g. `org-ql-view--link-store'."
(query (url-unhex-string query))
(params (when params (url-parse-query-string params)))
;; `url-parse-query-string' returns "improper" alists, which makes this awkward.
(sort (--when-let (alist-get "sort" params nil nil #'string=)
(read it)))
(sort (when-let* ((stored-string (alist-get "sort" params nil nil #'string=))
(read-value (read stored-string)))
;; Ensure the value is either a symbol or list of symbols (which excludes lambdas).
(unless (or (symbolp read-value) (cl-every #'symbolp read-value))
(error "Potentially unsafe value found in link's SORT parameter (%s). Link not opened"
read-value))
read-value))
(org-super-agenda-allow-unsafe-groups nil) ; Disallow unsafe group selectors.
(groups (--when-let (alist-get "super-groups" params nil nil #'string=)
(read it)))