Re: [BUG][SECURITY] ob-sqlite header args allows execution of arbitrary shell commands

[Ihor Radchenko]

Max Nikulin <manikulin@gmail.com> writes:

> Ihor, this is a list, not an expression to be evaluated. There are some 
> conditions to avoid user prompts for strings, lists, etc. They are 
> considered safe.
>
> This particular case is handled namely by ob-sqlite and the proposed 
> function in org-macs.

Do you have any ideas how to work around the deliberately constructed
header argument values like in your example?

-- 
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>