> doesn't even spell out the possibility of deliberate, ... multiline values It does for me, as any kind of extra newlines results in a multi-line string. > .

> doesn't even spell out the possibility of deliberate, ... multiline values It does for me, as any kind of extra newlines results in a multi-line string. > ... malicious ... Like Daniel said, garbage in, garbage out. If you pass user inputs to curl, one should check what curl does with these values and take proper care.