Re: [O] Org campture recursively expands %-escapes

[Nicolas Goaziou]

Hello,

Samuel Wales <address@hidden> writes:

> just to clarify,
>
>   "%(alpha-org-protocol-string \"%:link\" \"%:description\" \"%i\")"
>
> is not recursive, right?

It is. 

The first two are documented in org-capture-templates' docstring. So
I guess they are fine. However, the last parameter is problematic. As
pointed out by the OP, since it basically means "%(...)" are evaluated
after "%i", it can lead to the following chain of events:

  %i => %(evil-command) => Evil result.


Regards,

-- 
Nicolas Goaziou