mirror/org-mode
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/emacs/org-mode.git synced 2024-11-21 06:55:35 +00:00
Code

org-macro--set-templates: Prevent code evaluation

Browse Source 
* lisp/org-macro.el (org-macro--set-templates): Get rid of any
risk to evaluate code when `org-macro--set-templates' is called as a
part of major mode initialization.  This way, no code evaluation is
ever triggered when user merely opens the file or when
`mm-display-org-inline' invokes Org major mode to fontify mime part
preview in email messages.
This commit is contained in:
Ihor Radchenko 2024-02-20 12:19:46 +03:00
parent 01b540e21f
commit 003ddacf1c
No known key found for this signature in database
GPG Key ID: 6470762A7DA11D8B
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lisp/org-macro.el
View File

@ -109,6 +109,13 @@ previous one, unless VALUE is nil. Return the updated list."
(let ((new-templates nil))
(pcase-dolist (`(,name . ,value) templates)
(let ((old-definition (assoc name new-templates)))
;; This code can be evaluated unconditionally, as a part of
;; loading Org mode. We *must not* evaluate any code present
;; inside the Org buffer while loading. Org buffers may come
;; from various sources, like received email messages from
;; potentially malicious senders. Org mode might be used to
;; preview such messages and no code evaluation from inside the
;; received Org text should ever happen without user consent.
(when (and (stringp value) (string-match-p "\\`(eval\\>" value))
;; Pre-process the evaluation form for faster macro expansion.
(let* ((args (org-macro--makeargs value))
@ -121,7 +128,7 @@ previous one, unless VALUE is nil. Return the updated list."
(cadr (read value))
(error
(user-error "Invalid definition for macro %S" name)))))
(setq value (eval (macroexpand-all `(lambda ,args ,body)) t))))
(setq value `(lambda ,args ,body))))
(cond ((and value old-definition) (setcdr old-definition value))
(old-definition)
(t (push (cons name (or value "")) new-templates)))))