Content-Type: multipart/alternative;
 boundary="------------jfNgQYR5StM7anJ02g0KN5Go"
Message-ID: <c5cbabcb-27b5-4464-afb1-2a6f4d183def@dunslane.net>
Date: Thu, 27 Mar 2025 06:46:50 -0400
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: getting "shell command argument contains a newline or carriage
 return:" error with pg_dumpall when db name have new line in double quote
To: Srinath Reddy <srinath2133@gmail.com>,
 Mahendra Singh Thalor <mahi6run@gmail.com>
Cc: pgsql-hackers@lists.postgresql.org
References: 
 <CAKYtNApkOi4FY0S7+3jpTqnHVyyZ6Tbzhtbah-NBbY-mGsiKAQ@mail.gmail.com>
 <CAFC+b6qwc+wpt7_b2R6YhpDkrXeFvFd5NoLbTMMoxX9tfOHjpg@mail.gmail.com>
 <CAKYtNAreuQv04Mfy-u=TnOGrp2ofagRPV43XjjnbJb_5JDqC+Q@mail.gmail.com>
 <CAKYtNArY3-HQ53sCDynnhGqjr9DBi07nKjbj00U0tnsZJBnyoQ@mail.gmail.com>
 <CAFC+b6oiZ9b80jgZnYgWuxeOSkSGRhkb-Opjn59kR171sHE=XA@mail.gmail.com>
 <b3b91d97-fada-4700-a3fc-842566fbd537@dunslane.net>
 <CAFC+b6ocP-8VtvvgVU8npVPp4cc379DvDkRjdRKUc+fa2fKwwg@mail.gmail.com>
 <CAFC+b6rL3a=5tFGdcVuyHBPEpw_Zdv4HP+NGZvQZBCj07MU5Pg@mail.gmail.com>
From: Andrew Dunstan <andrew@dunslane.net>
Content-Language: en-US
Autocrypt: addr=andrew@dunslane.net; keydata=
 xsBNBE7KWFkBCAClridxur2AIc7eW2AR7izbfp3EnNefie2HbLF0izW5Ik5UjX2HBXBx4syI
 gY6b0ugohXrr274+baoAlvSbq6cAoQuEVrk5IZFzt20b1Xkx65FwGSEj526yiKLocqkJceSq
 Xr9xcA5SGY+FZv441chh5SU92v4q6z+6LPpoHOh97ptAVXZYNTtU0LevyvD5lja0TzbvJm6C
 eFXitJfnm1pLEr0DGJCR/iUOl/N62Kh4855zZC7NHIjQHPOvV5Stz/l5ilDhvGVk+xkXFPys
 SjZoUr1rXhYLpiyi5sR0X9FHXT0KnGuz1F5ERO7ZTLSSQ6fJwPj6gOk9K+vvoKvoeql5ABEB
 AAHNJEFuZHJldyBEdW5zdGFuIDxhbmRyZXdAZHVuc2xhbmUubmV0PsLAmwQTAQgARQIbAwIX
 gAIZAQULCQgHAgMiAgEGFQoJCAsCBBYCAwECHgcWIQTkPlhGHfx8v0RpFaWZ+n/LWfw7gQUC
 ZFlxxwUJGVGAbgAKCRCZ+n/LWfw7gXikB/9ZdcUy6CTBFIIuL/bVsc1eLEW/gJBjJBF6HxNY
 xgEkAgXAp4Lg4A5U+QB9GouFr7+GYxF0BU4hzoGhNPUWltxnHdMWP8nC/38LAqgMi8L/bbsm
 HW5YPBdWYaAZAPJQVfOAgjTbRUb26KSprpyrrJKW0ZmrZfjhNPcQ72jpWzoPLQqx2X6B0fru
 1jq+cBh8lb6r1mJTim1T3JIn+F/v5VpdQS+EL8xqsHkfzKjIPsW3CIXpkypSk6saA55Rkkbl
 26AW8ftPVB0Q6Lnn6FLt9CP0MGNixBQ55yq8r1K+nCBvCCjvQjM8RDm0UUum0WNl+ifQgTLO
 E8TWEnwVtkBf+3QWzsBNBE7KWFkBCADRnOM0FCzsYW6jtncg+dWIagjUZpvaClmqn/sJluLa
 Q3v1VXMQJzYs3eC1gh386W+XBwLRpDj3jzH81lX+p73Re3d3oJW7X+ffsxuzu5ZVdMUkqBYo
 nkAbKxr6gyJ12F/+JkUVzLcoTN+d/7YsQvUVi7NaKH8mJgjz112O4fUe3p9wfAaFa0RXHc5S
 GPzRTYRRlv/XZBIho4J2tkZOnteZJZ+GbxQVlINt6fd8P6al3MWOvpP/ExJPguEfjOsO6Njy
 xjo3WfpD4lHMOR/Oc3/8mScEF84rF2jXbsFgelWnbPWAvXY+pD0dXOFRkagGmC/viwBDqq5b
 5tk76kKmUbZxABEBAAHCwHwEGAEIACYCGwwWIQTkPlhGHfx8v0RpFaWZ+n/LWfw7gQUCZFlx
 5wUJGVGAjgAKCRCZ+n/LWfw7gf+iB/4g8CPY5jihf5r/8EsoIGe2H+dpVmpPF8YGBzTIvCz/
 fQoOq8AX/pE76QEuFnFZWfjw+wgBXgCVmkox2Eflkk6z4ND3pcwGZ6CfCxTQCDk/dij+2DQ4
 6bmDCy/sBgcbz9mTpoLC11HLoPae6YN9nBNQRZDcEFEu54OaVOqlIdbA6m+POIBCXZdHOFc0
 WoDTgxHRzC1jgQNidyd6tKqcsVJs0dzF0oKTmFFmUAqTdJO12LBuNA1rlqrR3EtpYk8B/wtS
 5dIMD7Q8hwQpL+4C6GNpb6ZKnPkLi47pDOLhz2qBrqN+rqUEsT3YnExYpzj5yOBi+FlmV1Hw
 49QYe1sn2ZPs
In-Reply-To: 
 <CAFC+b6rL3a=5tFGdcVuyHBPEpw_Zdv4HP+NGZvQZBCj07MU5Pg@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/c5cbabcb-27b5-4464-afb1-2a6f4d183def%40dunslane.net>
Precedence: bulk

This is a multi-part message in MIME format.
--------------jfNgQYR5StM7anJ02g0KN5Go
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit


On 2025-03-26 We 8:52 AM, Srinath Reddy wrote:
> sorry for the noise ,previous response had my editor's formatting,just 
> resending without that formatting.
>
> ./psql postgres
>
> Hi,
>
> On Wed, Mar 26, 2025 at 5:55 PM Andrew Dunstan <andrew@dunslane.net> 
> wrote:
>
>     You can still create a database with these using "CREATE DATABASE"
>     though. Shouldn't we should really be preventing that?
>
>
> yes, solution 1 which I mentioned prevents these while we are 
> using "CREATE DATABASE".
>
> /*
>   * Create a new database using the WAL_LOG strategy.
> @@ -741,6 +742,13 @@ createdb(ParseState *pstate, const CreatedbStmt 
> *stmt)
>   CreateDBStrategy dbstrategy = CREATEDB_WAL_LOG;
>   createdb_failure_params fparms;
>
> + /* Report error if dbname have newline or carriage return in name. */
> + if (is_name_contain_lfcr(dbname))
> + ereport(ERROR,
> + (errcode(ERRCODE_INVALID_PARAMETER_VALUE)),
> + errmsg("database name contains a newline or carriage return character"),
> + errhint("newline or carriage return character is not allowed in 
> database name"));
> +
>
> psql (18devel)
> Type "help" for help.
>
> postgres=# create database "test
> postgres"# lines";
> ERROR:  database name contains a newline or carriage return character
> HINT:  newline or carriage return character is not allowed in database 
> name
>
>


Yes, sorry, I misread the thread. I think we should proceed with options 
1 and 3 i.e. prevent creation of new databases with a CR or LF, and have 
pgdumpall exit with a more useful error message.

Your invention of an is_name_contain_lfcr() function is unnecessary - we 
can just use the standard library function strpbrk() to look for a CR or LF.


cheers


andrew


--
Andrew Dunstan
EDB:https://www.enterprisedb.com

--------------jfNgQYR5StM7anJ02g0KN5Go
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p><br>
    </p>
    <div class="moz-cite-prefix">On 2025-03-26 We 8:52 AM, Srinath Reddy
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAFC+b6rL3a=5tFGdcVuyHBPEpw_Zdv4HP+NGZvQZBCj07MU5Pg@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">
        <div dir="ltr">
          <div dir="ltr">
            <div>sorry for the noise ,previous response had my editor's
              formatting,just resending without that formatting.<br>
              <br>
              ./psql postgres<br>
              <br>
              Hi,</div>
            <br>
            <div class="gmail_quote"><span style="color:rgb(80,0,80)">
                <div dir="ltr" class="gmail_attr">On Wed, Mar 26, 2025
                  at 5:55 PM Andrew Dunstan &lt;<a
                    href="mailto:andrew@dunslane.net" target="_blank"
                    moz-do-not-send="true" class="moz-txt-link-freetext">andrew@dunslane.net</a>&gt;
                  wrote:</div>
                <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
                  <div>
                    <p>You can still create a database with these using
                      "CREATE DATABASE" though. Shouldn't we should
                      really be preventing that?</p>
                  </div>
                </blockquote>
              </span>
              <div><br>
                yes, solution 1 which I mentioned prevents these while
                we are using "CREATE DATABASE".<br>
                <br>
                /*<br>
                  * Create a new database using the WAL_LOG strategy.<br>
                @@ -741,6 +742,13 @@ createdb(ParseState *pstate, const
                CreatedbStmt *stmt)<br>
                  CreateDBStrategy dbstrategy = CREATEDB_WAL_LOG;<br>
                  createdb_failure_params fparms;<br>
                 <br>
                + /* Report error if dbname have newline or carriage
                return in name. */<br>
                + if (is_name_contain_lfcr(dbname))<br>
                + ereport(ERROR,<br>
                + (errcode(ERRCODE_INVALID_PARAMETER_VALUE)),<br>
                + errmsg("database name contains a newline or carriage
                return character"),<br>
                + errhint("newline or carriage return character is not
                allowed in database name"));<br>
                +<br>
                <br>
                psql (18devel)<br>
                Type "help" for help.<br>
                <br>
                postgres=# create database "test<br>
                postgres"# lines";<br>
                ERROR:  database name contains a newline or carriage
                return character<br>
                HINT:  newline or carriage return character is not
                allowed in database name</div>
              <div><span><br>
                </span></div>
              <br>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <p><br>
    </p>
    <p><br>
    </p>
    <p>Yes, sorry, I misread the thread. I think we should proceed with
      options 1 and 3 i.e. prevent creation of new databases with a CR
      or LF, and have pgdumpall exit with a more useful error message.</p>
    <p>Your invention of an is_name_contain_lfcr() function is
      unnecessary - we can just use the standard library function
      strpbrk() to look for a CR or LF.</p>
    <p><br>
    </p>
    <p>cheers</p>
    <p><br>
    </p>
    <p>andrew<br>
    </p>
    <p><br>
    </p>
    <pre class="moz-signature"
    signature-switch-id="d0437855-2267-4610-80b3-83167ec45b0b" cols="72">--
Andrew Dunstan
EDB: <a class="moz-txt-link-freetext" href="https://www.enterprisedb.com">https://www.enterprisedb.com</a>
</pre>
  </body>
</html>

--------------jfNgQYR5StM7anJ02g0KN5Go--