Re: Quoting issues with createdb

On Thu, Feb 27, 2020 at 12:00:11AM +0100, Daniel Gustafsson wrote:
> Makes sense, it aligns it with other utils and passes all the tests. +1 on the
> fix.

Thanks for the review.

> I would've liked a negative test basically along the lines of your example
> above. If we left a hole the size of this, it would be nice to catch it from
> accidentally happening again.

No arguments against that.

> program_help_ok('createdb');
> program_version_ok('createdb');
> @@ -24,3 +24,6 @@ $node->issues_sql_like(
>
> $node->command_fails([ 'createdb', 'foobar1' ],
> 'fails if database already exists');
> +
> +$node->command_fails(['createdb', '-l', 'C\';SELECT 1;' ],
> + 'fails on incorrect locale');

One problem with this way of testing things is that you don't check
the exact error message triggered, and this command fails with or
without the patch, so you don't actually know if things are correctly
patched up or not. What should be used instead is command_checks_all,
available down to 11 where we check for a failure and a match with the
error string generated. I have used that, and applied the patch down
to 9.5.
--
Michael