Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wNXdT-000t8M-31 for pgsql-committers@arkaria.postgresql.org; Thu, 14 May 2026 15:06:03 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wNX4Q-00D65a-0C for pgsql-committers@arkaria.postgresql.org; Thu, 14 May 2026 14:29:50 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMPeD-000mVW-30 for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:22:10 +0000 Received: from mahout.postgresql.org ([72.32.157.227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wMPeB-000000002hg-2cwJ for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:22:09 +0000 Received: from gemulon.postgresql.org ([72.32.157.198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMPbr-0005an-0B for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:19:43 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wMPbk-0002TN-2t for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:19:37 +0000 Content-Type: multipart/mixed; boundary="===============6199351813800475248==" MIME-Version: 1.0 From: Noah Misch To: pgsql-committers@lists.postgresql.org Subject: pgsql: Prevent path traversal in pg_basebackup and pg_rewind X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Mon, 11 May 2026 12:19:37 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============6199351813800475248== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 UHJldmVudCBwYXRoIHRyYXZlcnNhbCBpbiBwZ19iYXNlYmFja3VwIGFuZCBwZ19yZXdpbmQKCnBn X3Jld2luZCBhbmQgcGdfYmFzZWJhY2t1cCBjb3VsZCBiZSBmZWQgcGF0aHMgZnJvbSByb2d1ZSBl bmRwb2ludHMgdGhhdApjb3VsZCBvdmVyd3JpdGUgdGhlIGNvbnRlbnRzIG9mIHRoZSBjbGllbnQg d2hlbiByZWNlaXZlZCwgYWNoaWV2aW5nIHBhdGgKdHJhdmVyc2FsLgoKVGhlcmUgd2VyZSB0d28g YXJlYXMgaW4gdGhlIHRyZWUgdGhhdCB3ZXJlIHNlbnNpdGl2ZSB0byB0aGlzIHByb2JsZW06Ci0g cGdfYmFzZWJhY2t1cCwgdGhyb3VnaCB0aGUgYXN0cmVhbWVyIGNvZGUsIHdoZXJlIG5vIHZhbGlk YXRpb24gd2FzCnBlcmZvcm1lZCBiZWZvcmUgYnVpbGRpbmcgYW4gb3V0cHV0IHBhdGggd2hlbiBz dHJlYW1pbmcgdGFyIGRhdGEuICBUaGlzCmlzIGFuIGlzc3VlIGluIHYxNSBhbmQgbmV3ZXIgdmVy c2lvbnMuCi0gcGdfcmV3aW5kIGZpbGUgb3BlcmF0aW9ucyBmb3IgcGF0aHMgcmVjZWl2ZWQgdGhy b3VnaCBsaWJwcSwgZm9yIGFsbAp0aGUgc3RhYmxlIGJyYW5jaGVzIHN1cHBvcnRlZC4KCkluIG9y ZGVyIHRvIGFkZHJlc3MgdGhpcyBwcm9ibGVtLCB0aGlzIGNvbW1pdCBhZGRzIGEgaGVscGVyIGZ1 bmN0aW9uIGluCnBhdGguYywgdGhhdCByZXVzZXMgcGF0aF9pc19yZWxhdGl2ZV9hbmRfYmVsb3df Y3dkKCkgYWZ0ZXIgYXBwbHlpbmcKY2Fub25pY2FsaXplX3BhdGgoKS4gIFRoaXMgY2FuIGJlIHVz ZWQgdG8gdmFsaWRhdGUgdGhlIHBhdGhzIHJlY2VpdmVkCmZyb20gYSBjb25uZWN0aW9uIHBvaW50 LiAgQSBwYXRoIGlzIGNvbnNpZGVyZWQgaW52YWxpZCBpZiBhbnkgb2YgdGhlIHR3bwpmb2xsb3dp bmcgY29uZGl0aW9ucyBpcyBzYXRpc2ZpZWQ6Ci0gVGhlIHBhdGggaXMgYWJzb2x1dGUuCi0gVGhl IHBhdGggaW5jbHVkZXMgYSBkaXJlY3QgcGFyZW50LWRpcmVjdG9yeSByZWZlcmVuY2UuCgpSZXBv cnRlZC1ieTogWGxhYkFJIFRlYW0gb2YgVGVuY2VudCBYdWFud3UgTGFiClJlcG9ydGVkLWJ5OiBW YWxlcnkgR3ViYW5vdiA8dmFsZXJ5Z3ViYW5vdjk1QGdtYWlsLmNvbT4KQXV0aG9yOiBNaWNoYWVs IFBhcXVpZXIgPG1pY2hhZWxAcGFxdWllci54eXo+ClJldmlld2VkLWJ5OiBBbWl0IEthcGlsYSA8 YW1pdC5rYXBpbGExNkBnbWFpbC5jb20+CkJhY2twYXRjaC10aHJvdWdoOiAxNApTZWN1cml0eTog Q1ZFLTIwMjYtNjQ3NQoKQnJhbmNoCi0tLS0tLQptYXN0ZXIKCkRldGFpbHMKLS0tLS0tLQpodHRw czovL2dpdC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmL2ExMDYzZWVjZWRmMzc5ZGU1ZGFk NzNmOWJkNmU4NTZhZDVjMTE0ZmIKQXV0aG9yOiBNaWNoYWVsIFBhcXVpZXIgPG1pY2hhZWxAcGFx dWllci54eXo+CgpNb2RpZmllZCBGaWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmluL3BnX3Jld2lu ZC9maWxlX29wcy5jICB8IDIzICsrKysrKysrKysrKysrKysrKysrKysrCnNyYy9mZV91dGlscy9h c3RyZWFtZXJfZmlsZS5jIHwgMTIgKysrKysrKysrKysrCnNyYy9mZV91dGlscy9hc3RyZWFtZXJf dGFyLmMgIHwgIDQgKysrKwpzcmMvaW5jbHVkZS9wb3J0LmggICAgICAgICAgICB8ICAxICsKc3Jj L3BvcnQvcGF0aC5jICAgICAgICAgICAgICAgfCAxNyArKysrKysrKysrKysrKysrKwo1IGZpbGVz IGNoYW5nZWQsIDU3IGluc2VydGlvbnMoKykKCg== --===============6199351813800475248==--