Postgres log readers: read csvlog/jsonlog when a target writes them, so a client can't forge a line through %u/%d (#4046 part 2)

[erikdarlingdata]

Split from #4046. Parts 1, 1b and 1c stop a planted line from making a target's log read fail (#4049 is merged; #4051 is in review):

• a line stamped in another zone is skipped and counted;
• a byte that is not valid UTF-8 is read through pg_read_binary_file instead of throwing 22021.

They don't stop forgery. That is this issue.

The gap

In the stderr log format, a role or database name from the startup packet lands unescaped in the FATAL message. The server writes it before authentication. A newline in that name starts a new line of the client's choosing, and the line can carry a fake timestamp, pid and label under any log_line_prefix that puts %u/%d before %p. The RDS default, %t:%r:%u@%d:[%p]:, is one such prefix. No stderr parser can tell that line from a real one.

Fix

When a target's log_destination includes csvlog or jsonlog (PostgreSQL 15+), the three log-tail collectors read that file instead of the stderr one:

• pg_log_events
• pg_deadlocks
• pg_plan_capture

Today the tail CTE excludes \.(csv|json)$. The collectors need a real CSV/JSON parser. In those formats every field is quoted or escaped, so a planted newline stays inside its field.

• Self-hosted route: the tail CTE picks the newest .csv/.json file. A tail window can start mid-record, and a CSV record can span lines, so drop everything up to the first complete record.
• Managed route (RDS/Aurora): the log download API serves the .csv files when csvlog is on. Use the same parser.
• Keep the stderr path as the fallback. The logging audit (get_pg_logging_audit) should recommend csvlog or jsonlog and give this reason.
• Keep Byte route (pg_read_binary_file) and managed-zone log_timezone (#4046 parts 1b, 1c) #4051's binary route: a CSV or JSON file can carry the same invalid byte.

Also open, carried over from #4051

Nobody knows yet whether AWS's log download re-encodes or rejects a byte that is not valid UTF-8. Test it on a throwaway RDS instance.

Done when

• CSV and JSON parsing covers all three collectors, on both the self-hosted and managed routes.
• A forged-newline test proves the planted line stays inside its field.
• A live check has run on a rig with csvlog on.

[erikdarlingdata]

PR #4104 merged to dev as 21b5d51 (2026-09-24 02:22Z). It adds the csvlog parser (PgServerLogCsvParser) and its tests only. Nothing calls it yet, so there is no behaviour change. This issue stays open: wiring the parser into the collectors and jsonlog support follow in separate PRs.

[erikdarlingdata]

PR #4112 merged to dev as 90d6af4 (2026-09-24 03:16Z). It adds the jsonlog parser (PgServerLogJsonParser) and its tests only, the jsonlog counterpart of #4104's csvlog parser. Nothing calls it yet, so there is no behaviour change. This issue stays open: wiring the parsers into the collectors follows in a separate PR.

[erikdarlingdata]

PR #4140 merged to dev as fc61f09 (2026-09-24 05:19Z). It carries the second round of review fixes for #4124's csvlog wiring. The parser now scores two quote-parity hypotheses in one backward pass instead of trying up to 8 anchor candidates, which closes the gap where a trailing partial record with many embedded newlines hid the true parity. Callers can state the record edges they already know. The log-format capability cache is now invalidated only for the collectors that are routed through it. This issue stays open: the remaining csvlog readers follow in separate PRs.

[erikdarlingdata]

PR #4136 merged to dev as a95753f (2026-09-24 05:43Z). This is part b1: pg_deadlocks now reads the csvlog file when the target has csvlog in log_destination, the same way pg_log_events does. The csv route runs no server-side regex. It parses the tail with PgServerLogCsvParser, applies the same foreign-zone rules as the stderr route, and keeps only the entries PgDeadlockLogParser.FromEntry recognises as deadlock reports. A forged deadlock-shaped line inside a quoted field stays inside its record. The stderr route is unchanged. This issue stays open for the remaining parts.