Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wNXn9-000tJn-21 for pgsql-committers@arkaria.postgresql.org; Thu, 14 May 2026 15:16:03 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wNX44-00D4jG-02 for pgsql-committers@arkaria.postgresql.org; Thu, 14 May 2026 14:29:28 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMPcC-000mP3-2h for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:20:04 +0000 Received: from mahout.postgresql.org ([72.32.157.227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wMPbv-000000002cU-3ipW for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:20:04 +0000 Received: from gemulon.postgresql.org ([72.32.157.198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wMPbp-0005ao-1I for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:19:42 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wMPbp-0002g9-0M for pgsql-committers@lists.postgresql.org; Mon, 11 May 2026 12:19:41 +0000 Content-Type: multipart/mixed; boundary="===============1954245021867492106==" MIME-Version: 1.0 From: Noah Misch To: pgsql-committers@lists.postgresql.org Subject: pgsql: Prevent path traversal in pg_basebackup and pg_rewind X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Mon, 11 May 2026 12:19:41 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============1954245021867492106== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 UHJldmVudCBwYXRoIHRyYXZlcnNhbCBpbiBwZ19iYXNlYmFja3VwIGFuZCBwZ19yZXdpbmQKCnBn X3Jld2luZCBhbmQgcGdfYmFzZWJhY2t1cCBjb3VsZCBiZSBmZWQgcGF0aHMgZnJvbSByb2d1ZSBl bmRwb2ludHMgdGhhdApjb3VsZCBvdmVyd3JpdGUgdGhlIGNvbnRlbnRzIG9mIHRoZSBjbGllbnQg d2hlbiByZWNlaXZlZCwgYWNoaWV2aW5nIHBhdGgKdHJhdmVyc2FsLgoKVGhlcmUgd2VyZSB0d28g YXJlYXMgaW4gdGhlIHRyZWUgdGhhdCB3ZXJlIHNlbnNpdGl2ZSB0byB0aGlzIHByb2JsZW06Ci0g cGdfYmFzZWJhY2t1cCwgdGhyb3VnaCB0aGUgYXN0cmVhbWVyIGNvZGUsIHdoZXJlIG5vIHZhbGlk YXRpb24gd2FzCnBlcmZvcm1lZCBiZWZvcmUgYnVpbGRpbmcgYW4gb3V0cHV0IHBhdGggd2hlbiBz dHJlYW1pbmcgdGFyIGRhdGEuICBUaGlzCmlzIGFuIGlzc3VlIGluIHYxNSBhbmQgbmV3ZXIgdmVy c2lvbnMuCi0gcGdfcmV3aW5kIGZpbGUgb3BlcmF0aW9ucyBmb3IgcGF0aHMgcmVjZWl2ZWQgdGhy b3VnaCBsaWJwcSwgZm9yIGFsbAp0aGUgc3RhYmxlIGJyYW5jaGVzIHN1cHBvcnRlZC4KCkluIG9y ZGVyIHRvIGFkZHJlc3MgdGhpcyBwcm9ibGVtLCB0aGlzIGNvbW1pdCBhZGRzIGEgaGVscGVyIGZ1 bmN0aW9uIGluCnBhdGguYywgdGhhdCByZXVzZXMgcGF0aF9pc19yZWxhdGl2ZV9hbmRfYmVsb3df Y3dkKCkgYWZ0ZXIgYXBwbHlpbmcKY2Fub25pY2FsaXplX3BhdGgoKS4gIFRoaXMgY2FuIGJlIHVz ZWQgdG8gdmFsaWRhdGUgdGhlIHBhdGhzIHJlY2VpdmVkCmZyb20gYSBjb25uZWN0aW9uIHBvaW50 LiAgQSBwYXRoIGlzIGNvbnNpZGVyZWQgaW52YWxpZCBpZiBhbnkgb2YgdGhlIHR3bwpmb2xsb3dp bmcgY29uZGl0aW9ucyBpcyBzYXRpc2ZpZWQ6Ci0gVGhlIHBhdGggaXMgYWJzb2x1dGUuCi0gVGhl IHBhdGggaW5jbHVkZXMgYSBkaXJlY3QgcGFyZW50LWRpcmVjdG9yeSByZWZlcmVuY2UuCgpSZXBv cnRlZC1ieTogWGxhYkFJIFRlYW0gb2YgVGVuY2VudCBYdWFud3UgTGFiClJlcG9ydGVkLWJ5OiBW YWxlcnkgR3ViYW5vdiA8dmFsZXJ5Z3ViYW5vdjk1QGdtYWlsLmNvbT4KQXV0aG9yOiBNaWNoYWVs IFBhcXVpZXIgPG1pY2hhZWxAcGFxdWllci54eXo+ClJldmlld2VkLWJ5OiBBbWl0IEthcGlsYSA8 YW1pdC5rYXBpbGExNkBnbWFpbC5jb20+CkJhY2twYXRjaC10aHJvdWdoOiAxNApTZWN1cml0eTog Q1ZFLTIwMjYtNjQ3NQoKQnJhbmNoCi0tLS0tLQpSRUxfMTRfU1RBQkxFCgpEZXRhaWxzCi0tLS0t LS0KaHR0cHM6Ly9naXQucG9zdGdyZXNxbC5vcmcvcGcvY29tbWl0ZGlmZi80OTg4MjlkY2E0NWFk MjA3YTIzOTU0ZmUyZTVhMzBlZDJlZjRiMzYzCkF1dGhvcjogTWljaGFlbCBQYXF1aWVyIDxtaWNo YWVsQHBhcXVpZXIueHl6PgoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3JjL2Jpbi9w Z19yZXdpbmQvZmlsZV9vcHMuYyB8IDIzICsrKysrKysrKysrKysrKysrKysrKysrCnNyYy9pbmNs dWRlL3BvcnQuaCAgICAgICAgICAgfCAgMSArCnNyYy9wb3J0L3BhdGguYyAgICAgICAgICAgICAg fCAxNyArKysrKysrKysrKysrKysrKwozIGZpbGVzIGNoYW5nZWQsIDQxIGluc2VydGlvbnMoKykK Cg== --===============1954245021867492106==--