Event description text can break inbox heading structure

[jeffvalk]

tl;dr: Event description text is handled literally. It needs to be escaped.

Overview

The record delimiter of any structured format should always be escaped before writing. For an org-caldav inbox, the delimiter is the org headline indicator (start of line + stars + space).

In order to avoid breaking the org file's structure, any headline indicator string at or above the level at which events are stored in the inbox file must be escaped from the event description text before that data is written to the org file.

Example

Here's an example event description:

In our meeting, we'll discuss occurance of an asterisk (star character) at the beginning of a line
in an event's description field. Points to consider:

* Calendar/email clients often convert HTML unordered lists to plain text using asterisks
* Markdown is very common, and asterisks are markdown bullet list indicators
* Org users may consume calendar events created by non Org users. 
  We shouldn't expect event descriptions to be sanitized by default.

Currently, if a new event with the description above were synced from CalDAV to an org inbox, it would create 4 new headlines. The first would have its useful description content missing, and the following three would be erroneous.

Escaping and unescaping

Escaping should not change the synced data (or its hash/digest), only its local representation. Hence, escape (on write) needs a counterpart unescape (on read).

The Org manual recommends using the zero width space for escaping in the general case. Something like:

  (defun org-caldav--escape-string (string)
    "Escape STRING for org format using zero-width spaces (U+200B)."
    (replace-regexp-in-string "^\\* " "\u200B* " string)) ; star at beginning of line

  (defun org-caldav--unescape-string (string)
    "Remove org format escaping in STRING."
    (replace-regexp-in-string "^\\u200B\\* " "* " string))  

And this would allow other escaping to be added, should it ever be needed.

Headline level

The above example code assumes that events are written to the inbox file as top-level headlines. In practice, we would need to examine org-caldav-inbox or the :inbox property of org-caldav-calendars to determine the headline level to escape.

[jackkamm]

Yes it would be good to fix this. A PR (preferably with unit test) would be very welcome.

I think all headline levels should be escaped as having a subheadline within the event description could also cause problems.