On Mon, Feb 02, 2026 at 09:14:28AM -0500, Tom Lane wrote:
> =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@alvh.no-ip.org> writes:
>> This is not an objection to this patch, but I don't see why we should
>> allow newlines in tablespace names if we're going to restrict them in
>> names of roles and databases. Is it only because pg_dumpall happens not
>> to dump a comment with the tablespace name on it, like we do for dbs and
>> roles? Sounds unprincipled.
>> I think keeping these things under the same rules makes the most sense.
>
> Yeah, I was thinking the same.
A while back, I did a bit of testing with a patch that disallowed line
feeds and carriage returns in all names by adding a check to namein,
namerecv, and namestrcpy. I'm not sure exactly why I stopped, but that
seemed to work relatively well, although it is a quite large hammer. I
also recall seeing this thread from 2016 [0], which I don't think has been
cited here.
In any case, even if this change goes through, we'll need to teach
applications like pg_dump to either 1) verify there are no names with \n\r
or 2) handle them appropriately for all supported server versions. IMHO
(2) is quite fragile.
[0] https://postgr.es/m/flat/CAB7nPqRbDwmrZW-W6QW6AwiL1WoZJO4XJ-b1%2B_O4xyy67zn%3DFw%40mail.gmail.com
--
nathan
