From: Noah Misch <noah@leadboat.com>
Date: Tue, 30 Jun 2026 02:41:09 +0000 (-0700)
Subject: Restore comment at appendShellString().
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cfa573cf8cbdcbf7cbcae34911bd1ee292abdd2f;p=thirdparty%2Fpostgresql.git

Restore comment at appendShellString().

Commit b380a56a3f9556588a89013b765d67947d54f7d0 removed a paragraph, but
two of the paragraph's three sentences remained relevant.

Backpatch-through: 19
---

diff --git a/src/fe_utils/string_utils.c b/src/fe_utils/string_utils.c
index 38fffbd036b..7a762251f32 100644
--- a/src/fe_utils/string_utils.c
+++ b/src/fe_utils/string_utils.c
@@ -568,6 +568,10 @@ appendByteaLiteral(PQExpBuffer buf, const unsigned char *str, size_t length,
  * Append the given string to the shell command being built in the buffer,
  * with shell-style quoting as needed to create exactly one argument.
  *
+ * Forbid LF or CR characters, which have scant practical use beyond designing
+ * security breaches.  The Windows command shell is unusable as a conduit for
+ * arguments containing LF or CR characters.
+ *
  * appendShellString() simply prints an error and dies if LF or CR appears.
  * appendShellStringNoError() omits those characters from the result, and
  * returns false if there were any.