Subject: bug#48676: Arbitrary code execution in Org export macros

From: Ihor Radchenko <[email-masked]>
Date: Sat, 15 Mar 2025 17:36:20 +0000

Stefan Kangas <[email-masked]> writes:

>> #+macro: hello (eval (shell-command-to-string "touch /tmp/HELLO"))
>> Hello. {{{hello}}}
>>
>> Then:
>> M-x org-export-dispatch
>> t A
>>
>> -> now /tmp/HELLO exist, with no prompting.
>>
>> This seems contrary to normal Emacs practice for risky local variables,
>> and to the section "Code Evaluation and Security Issues" in the Org manual
>> (which does not mention macros).
>
> Ihor, could you please look into this bug?

This is a known problem.
I do not see it as a bug (user needs to execute a command), but indeed
code evaluation control should eventually be improved. It should just be
designed properly.

See more discussion in https://list.orgmode.org/orgmode/87edsd5o89.fsf@localhost/

-- 
Ihor Radchenko // yantar92,
Org mode maintainer,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>