upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-07-07 00:30:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Restore comment at appendShellString().

Browse source 
Commit b380a56a3f removed a paragraph, but
two of the paragraph's three sentences remained relevant.

Backpatch-through: 19
This commit is contained in:
Noah Misch 2026-06-29 19:41:09 -07:00
parent 8d85cb889a
commit cfa573cf8c
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/fe_utils/string_utils.c
View file

@ -568,6 +568,10 @@ appendByteaLiteral(PQExpBuffer buf, const unsigned char *str, size_t length,
* Append the given string to the shell command being built in the buffer,
* with shell-style quoting as needed to create exactly one argument.
*
* Forbid LF or CR characters, which have scant practical use beyond designing
* security breaches. The Windows command shell is unusable as a conduit for
* arguments containing LF or CR characters.
*
* appendShellString() simply prints an error and dies if LF or CR appears.
* appendShellStringNoError() omits those characters from the result, and
* returns false if there were any.