> On 17 Jul 2026, at 14:10, Bohyun Lee <[email protected]> wrote:
> • Reworked the manual-initdb docs: the vague "use compatible initdb > flags" is now the specific settings that must match (WAL segment size, > checksums, encoding, locale), with a pointer to pg_controldata. Regardless of the rest of the patch, I think we should apply something like this to the docs. I propose you extract this portion into a separate 0001 in this patchset so that it can be considered individually. I haven't had a chance to look at the new version more than at skim-level but the below caught my eye. + initPQExpBuffer(&cmd); + appendPQExpBuffer(&cmd, "\"%s/initdb\" -D \"%s\" -N", + new_cluster.bindir, new_cluster.pgdata); + appendPQExpBuffer(&cmd, " -U \"%s\"", os_info.user); This will inject the username specified in the (untrusted input) commandline into the initdb command and execute it. While that will work in benign cases, it seems like a Booby Tables pattern which is best left in the coding practices of the past and in XKCD? -- Daniel Gustafsson
