Re: BUG #19730: PostgreSQL `pg_backup_start` accepts newlines in the backup label, producing an unrestorable `backup

On Thu, Oct 01, 2026 at 08:25:05PM -0700, David G. Johnston wrote:
> The fix request seems like something we should just do barring foreseen
> issues doing so. The system should not accept inputs it knows are
> incompatible with the output it needs to produce. I agree there isn’t a
> reason to try and make this usage actually work.

I tend to agree with you here. There is no real use case in allowing
CR and LF characters in backup label names. If somebody has the idea
to abuse of that to introduce custom data into a label file, that's
probably a very bad idea anyway because it would overwrite the fields
a backend things are the good ones when producing the backup_label
file, leading to a most-probably broken instance.

In short, I'm on board with the addition of an extra check that
enforces this policy in do_pg_backup_start(), marking label files
coming from the SQL functions as much as the replication command
BASE_BACKUP.

Side note: v19 now disallows CRLFs in role, database and tablespace
names, see b380a56a3f95 and the reasons why. The same reasons do not
apply here, and are much lighter as a CRLF would only manipulate a
server to do an incorrect recovery. Like the other one, that's just
wrong.

Perhaps we should add one test query somewhere in a TAP script of
src/test/recovery/, while on it.
--
Michael