From: Michael Paquier <michael@paquier.xyz>
To: David G. Johnston <david.g.johnston@gmail.com>
Cc: shihao zhong <zhong950419@gmail.com>
Cc: theshallow27@gmail.com <theshallow27@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: BUG #19730: PostgreSQL `pg_backup_start` accepts newlines in the backup label, producing an unrestorable `backup
Date: Fri, 2 Oct 2026 12:49:27 +0900
Message-ID: <ar8px1yG51ESobdm@paquier.xyz> (raw)
In-Reply-To: <CAKFQuwbjp=jg5_K3W3pP8cuO68B5R=NOuRRo6ZCvTMyZMyW8rQ@mail.gmail.com>
References: <19730-85a6044c9e72774a@postgresql.org>
<CAGRkXqTGP7BRT5Xv+xJoSc3egpPtC0h-LH-w4GxzQSt5qg7iLg@mail.gmail.com>
<CAKFQuwbjp=jg5_K3W3pP8cuO68B5R=NOuRRo6ZCvTMyZMyW8rQ@mail.gmail.com>
On Thu, Oct 01, 2026 at 08:25:05PM -0700, David G. Johnston wrote:
> The fix request seems like something we should just do barring foreseen
> issues doing so. The system should not accept inputs it knows are
> incompatible with the output it needs to produce. I agree there isn’t a
> reason to try and make this usage actually work.
I tend to agree with you here. There is no real use case in allowing
CR and LF characters in backup label names. If somebody has the idea
to abuse of that to introduce custom data into a label file, that's
probably a very bad idea anyway because it would overwrite the fields
a backend things are the good ones when producing the backup_label
file, leading to a most-probably broken instance.
In short, I'm on board with the addition of an extra check that
enforces this policy in do_pg_backup_start(), marking label files
coming from the SQL functions as much as the replication command
BASE_BACKUP.
Side note: v19 now disallows CRLFs in role, database and tablespace
names, see b380a56a3f95 and the reasons why. The same reasons do not
apply here, and are much lighter as a CRLF would only manipulate a
server to do an incorrect recovery. Like the other one, that's just
wrong.
Perhaps we should add one test query somewhere in a TAP script of
src/test/recovery/, while on it.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../ar8px1yG51ESobdm@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: michael@paquier.xyz, david.g.johnston@gmail.com, zhong950419@gmail.com, theshallow27@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19730: PostgreSQL `pg_backup_start` accepts newlines in the backup label, producing an unrestorable `backup
In-Reply-To: <ar8px1yG51ESobdm@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox