Security mechanism can be defeated by using %>%

[ianmcook]

The mechanism that stops queryparser from translating an expression if it includes functions that are not on the whitelist can be defeated by using a function name with no parentheses and using the forward pipe operator %>% to pass input to the function. For example:

parse_expression("'ls' %>% system")
#system("ls")

This is caused by the %>% operator being explicitly allowed in the query at the time when the check is performed

[ianmcook]

Fixed in 2b2082e