This prevents arbitrary code execution when opening "org-ql-search:" links. (The links feature was just pushed to master in the last day or so, and no stable release with the feature has been tagged.) This fix also means that arbitrary expressions are no longer accepted when interactively completing the buffers-files argument to org-ql-search (a worthy trade, I think; users who need to do that can call the function from Lisp).
46 KiB
46 KiB