On Sun, Sep 20, 2020 at 01:15:26PM -0400, Tom Lane wrote: > Bruce Momjian <bruce@xxxxxxxxxx> writes: > > On Mon, Sep 14, 2020 at 05:39:57PM -0400, Tom Lane wrote: > >> On the other hand, the very same thing could be said of database names > >> and role names, yet we have never worried much about whether those were > >> encoding-safe when viewed from databases with different encodings, nor > >> have there been many complaints about the theoretical unsafety. So maybe > >> this is just overly anal-retentive and we should drop the restriction, > >> or at least pass through data that doesn't appear to be invalidly > >> encoded. > > > I think the issue is that role and database names are controlled by > > privileged users, while application_name is not. > > That's certainly an argument against a completely laissez-faire approach, > but if we filtered invalidly-encoded data on the reading side, it seems > like we would be in good enough shape. Yes, if we want to filter, sure. I thought we were not 100% able to filter, but I guess if it safe, we can do it. -- Bruce Momjian <bruce@xxxxxxxxxx> https://momjian.us EnterpriseDB https://enterprisedb.com The usefulness of a cup is in its emptiness, Bruce Lee
