Re: [BUG][SECURITY] ob-sqlite header args allows execution of arbitrary shell commands

[Max Nikulin <manikulin@gmail.com>]

On 18/08/2023 18:05, Ihor Radchenko wrote:
> Max Nikulin writes:
> 
>> Ihor, this is a list, not an expression to be evaluated. There are some
>> conditions to avoid user prompts for strings, lists, etc. They are
>> considered safe.
>>
>> This particular case is handled namely by ob-sqlite and the proposed
>> function in org-macs.
> 
> Do you have any ideas how to work around the deliberately constructed
> header argument values like in your example?

Perhaps `gensym' may be used to create a symbol that can not appear in a 
document. I am unsure if the following `pcase' variant may be improved

(`(,(and s (guard (eq s ob-literal-symbol))) ,(and (pred stringp) str))
  str)

for

;; or ob-shell-argument-literal-symbol
(defconst ob-literal-symbol (gensym "literal"))

I hope, list values can not be used to bypass escaping with such 
approach. It is still possible to use evaluated expressions, but user 
prompt for such cases should be fixed anyway.

P.S. Babel backends should be consistent in respect to treating options 
for header arguments:
- use as is
- expand ~user and $VAR
- allow any shell expression