On 2016-08-18 09:14:44 +0900, Michael Paquier wrote: > On Thu, Aug 18, 2016 at 12:21 AM, Ryan Murphy <ryanfmur...@gmail.com> wrote: > > I have created a better patch (attached) that correctly escapes the shell > > arguments using PQExpBufferStr and the appendShellString function, as per > > Michael and Andres' suggestions. > > > > Further suggestions welcome of course. > > As far as I know, it is perfectly possible to have LF/CR in a path > name (that's bad practice btw...), and your patch would make initdb > fail in such cases. Do we want to authorize that?
I think that's actually a good thing to forbid. -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
