emacs-orgmode@gnu.org archives
 help / color / mirror / code / Atom feed
* Org campture recursively expands %-escapes
@ 2015-11-21 22:06 Thomas Preindl
  2015-11-26 12:54 ` Nicolas Goaziou
  0 siblings, 1 reply; 26+ messages in thread
From: Thomas Preindl @ 2015-11-21 22:06 UTC (permalink / raw)
  To: emacs-orgmode

[-- Attachment #1: Type: text/plain, Size: 827 bytes --]

Hi everyone,

setting up my capture templates to work with a new Chrome extension I
noticed that when i mark some text containing %-escapes inserted with the
'%i' in the template the %-escape was
evaluated.

For example, marking %(print (buffer-name)) will be replaced with
"*Capture*".

I am now wondering if this is intended or not and if this could be
used as a kind of exploit to run code if someone captures code
from a website.

Is there a way to prevent this? I thought about escaping the string, but I
would have to change the chrome extension or maybe is it possible to escape
it somehow in the template?

Here is my template:
("p" "org-protocol-Ch-marked" entry (file refile-path)
         "* %:description\n  %U\n  %:link\n  #+BEGIN_QUOTE\n  %i\n
 #+END_QUOTE"  :immediate-finish t :empty-lines-after 1)

br,
Thomas

[-- Attachment #2: Type: text/html, Size: 1139 bytes --]

^ permalink raw reply	[flat|nested] 26+ messages in thread

end of thread, other threads:[~2016-01-13  7:21 UTC | newest]

Thread overview: 26+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-11-21 22:06 Org campture recursively expands %-escapes Thomas Preindl
2015-11-26 12:54 ` Nicolas Goaziou
2015-11-26 18:52   ` Samuel Wales
2015-11-26 22:02     ` Nicolas Goaziou
2015-11-26 22:10       ` Samuel Wales
2015-11-26 23:02         ` Nicolas Goaziou
2015-11-29 16:00           ` Nicolas Goaziou
2016-01-03 11:44             ` Michael Brand
2016-01-03 19:51               ` Nicolas Goaziou
2016-01-03 20:39                 ` Michael Brand
2016-01-03 21:07                   ` Nicolas Goaziou
2016-01-04  1:52                     ` Michael Brand
2016-01-05 23:39                       ` Nicolas Goaziou
2016-01-06  5:45                         ` Michael Brand
2016-01-07 16:35                           ` Nicolas Goaziou
2016-01-08 20:59                             ` Michael Brand
2016-01-08 22:44                               ` Nicolas Goaziou
2016-01-09 15:53                                 ` Michael Brand
2016-01-09 16:05                                   ` Nicolas Goaziou
2016-01-09 16:31                                     ` Michael Brand
2016-01-09 17:54                                       ` Nicolas Goaziou
2016-01-10  8:08                                         ` Michael Brand
2016-01-11 23:05                                           ` Nicolas Goaziou
2016-01-12  7:30                                             ` Michael Brand
2016-01-12  8:42                                               ` Nicolas Goaziou
2016-01-13  7:21                                                 ` Michael Brand

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).