procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

org-macro--set-templates: Prevent code evaluation

Browse source 
* lisp/org/org-macro.el (org-macro--set-templates): Get rid of any
risk to evaluate code when `org-macro--set-templates' is called as a
part of major mode initialization.  This way, no code evaluation is
ever triggered when user merely opens the file or when
`mm-display-org-inline' invokes Org major mode to fontify mime part
preview in email messages.
This commit is contained in:
Ihor Radchenko 2024-02-20 12:19:46 +03:00 • committed by Eli Zaretskii
parent 3221d8d461
commit befa9fcaae
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lisp/org/org-macro.el
View file

@ -109,6 +109,13 @@ previous one, unless VALUE is nil. Return the updated list."
(let ((new-templates nil)) (let ((new-templates nil))
(pcase-dolist (`(,name . ,value) templates) (pcase-dolist (`(,name . ,value) templates)
(let ((old-definition (assoc name new-templates))) (let ((old-definition (assoc name new-templates)))
;; This code can be evaluated unconditionally, as a part of
;; loading Org mode. We *must not* evaluate any code present
;; inside the Org buffer while loading. Org buffers may come
;; from various sources, like received email messages from
;; potentially malicious senders. Org mode might be used to
;; preview such messages and no code evaluation from inside the
;; received Org text should ever happen without user consent.
(when (and (stringp value) (string-match-p "\\`(eval\\>" value)) (when (and (stringp value) (string-match-p "\\`(eval\\>" value))
;; Pre-process the evaluation form for faster macro expansion. ;; Pre-process the evaluation form for faster macro expansion.
(let* ((args (org-macro--makeargs value)) (let* ((args (org-macro--makeargs value))
@ -121,7 +128,7 @@ previous one, unless VALUE is nil. Return the updated list."
(cadr (read value)) (cadr (read value))
(error (error
(user-error "Invalid definition for macro %S" name))))) (user-error "Invalid definition for macro %S" name)))))
(setq value (eval (macroexpand-all `(lambda ,args ,body)) t)))) (setq value `(lambda ,args ,body))))
(cond ((and value old-definition) (setcdr old-definition value)) (cond ((and value old-definition) (setcdr old-definition value))
(old-definition) (old-definition)
(t (push (cons name (or value "")) new-templates))))) (t (push (cons name (or value "")) new-templates)))))