Quoting issues with createdb

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: Postgres hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: Quoting issues with createdb
Date: 2020-02-14 04:10:04
Message-ID: 20200214041004.GB1998@paquier.xyz
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi all,

createdb has a couple of issues with its quoting. For example take
that, which can be confusing:
$ createdb --lc-ctype="en_US.UTF-8';create table aa();select '1" popo
createdb: error: database creation failed: ERROR: CREATE DATABASE
cannot run inside a transaction block

The root of the issue is that any values added by the command caller
with --lc-collate, --lc-ctype or --encoding are not quoted properly,
and in all three cases it means that the quoting needs to be
encoding-sensitive (Tom mentioned me directly that part). This proper
quoting can be achieved using appendStringLiteralConn() from
string_utils.c, at the condition of taking the connection to the
server before building the CREATE DATABASE query.

Note that for --encoding, this is less of a problem as there is some
extra validation with pg_char_to_encoding(), but it seems better to me
to be consistent.

So this gives the patch attached, where the error becomes:
ERROR: invalid locale name: "en_US.UTF-8';create table aa();select '1"

Any opinions?
--
Michael

Attachment Content-Type Size
createdb-quotes-v1.patch text/x-diff 1.8 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Amit Langote 2020-02-14 04:29:08 Re: In PG12, query with float calculations is slower than PG11
Previous Message Fujii Masao 2020-02-14 03:47:19 Re: Wait event that should be reported while waiting for WAL archiving to finish