lib/PublicInbox/Config.pm |  5 ++++-
 script/public-inbox-init  |  1 +
 t/config.t                | 16 +++++++++++++---
 t/init.t                  |  8 ++++++++

diff --git a/lib/PublicInbox/Config.pm b/lib/PublicInbox/Config.pm
index c0e2cc575ec640ff1532edcc16d501660e5e4f28..67199bb3754bfb6a6f8aa874f5b9d3a312da4736 100644
--- a/lib/PublicInbox/Config.pm
+++ b/lib/PublicInbox/Config.pm
@@ -393,7 +393,10 @@ 	}
 
 	# backwards compatibility:
 	$ibx->{inboxdir} //= $self->{"$pfx.mainrepo"};
-
+	if (($ibx->{inboxdir} // '') =~ /\n/s) {
+		warn "E: `$ibx->{inboxdir}' must not contain `\\n'\n";
+		return;
+	}
 	foreach my $k (qw(obfuscate)) {
 		my $v = $self->{"$pfx.$k"};
 		defined $v or next;
diff --git a/script/public-inbox-init b/script/public-inbox-init
index c7f3da6f28a5f8fe10511c41e32f890ca70b40f3..951338af019524cd1c4ce75a35aa78a468fd2803 100755
--- a/script/public-inbox-init
+++ b/script/public-inbox-init
@@ -115,6 +115,7 @@ my $pfx = "publicinbox.$name";
 my @x = (qw/git config/, "--file=$pi_config_tmp");
 
 $inboxdir = abs_path($inboxdir);
+die "`\\n' not allowed in `$inboxdir'\n" if $inboxdir =~ /\n/s;
 if (-f "$inboxdir/inbox.lock") {
 	if (!defined $version) {
 		$version = 2;
diff --git a/t/config.t b/t/config.t
index ad543ad3638c0c0c78022502bfef812fdf2492bd..d7fd94460dd052d982bd35473b5f7dd2486a70e8 100644
--- a/t/config.t
+++ b/t/config.t
@@ -10,13 +10,23 @@ my ($tmpdir, $for_destroy) = tmpdir();
 
 {
 	PublicInbox::Import::init_bare($tmpdir);
-	my @cmd = ('git', "--git-dir=$tmpdir", qw(config foo.bar), "hi\nhi");
+	my $inboxdir = "$tmpdir/new\nline";
+	my @cmd = ('git', "--git-dir=$tmpdir",
+		qw(config publicinbox.foo.inboxdir), $inboxdir);
 	is(xsys(@cmd), 0, "set config");
 
 	my $tmp = PublicInbox::Config->new("$tmpdir/config");
 
-	is("hi\nhi", $tmp->{"foo.bar"}, "config read correctly");
-	is("true", $tmp->{"core.bare"}, "used --bare repo");
+	is($tmp->{'publicinbox.foo.inboxdir'}, $inboxdir,
+		'config read correctly');
+	is($tmp->{'core.bare'}, 'true', 'init used --bare repo');
+
+	my @warn;
+	local $SIG{__WARN__} = sub { push @warn, @_ };
+	$tmp = PublicInbox::Config->new("$tmpdir/config");
+	is($tmp->lookup_name('foo'), undef, 'reject invalid inboxdir');
+	like("@warn", qr/^E:.*must not contain `\\n'/sm,
+		'warned about newline');
 }
 
 {
diff --git a/t/init.t b/t/init.t
index 5c021be729bc7ed094987b9af2d1aac085094d26..b8f17b5c4805c3338b4fe8476ac64757ed5b41ad 100644
--- a/t/init.t
+++ b/t/init.t
@@ -49,6 +49,14 @@ 	is($? >> 8, 255, 'got expected exit code on lock failure');
 	ok(unlink("$cfgfile.lock"),
 		'-init did not unlink lock on failure');
 }
+{
+	my $rdr = { 2 => \(my $err = '') };
+	my $cmd = [ '-init', 'alist', "$tmpdir/a\nlist",
+		   qw(http://example.com/alist alist@example.com) ];
+	ok(!run_script($cmd, undef, $rdr),
+		'public-inbox-init rejects LF in inboxdir');
+	like($err, qr/`\\n' not allowed in `/s, 'reported \\n');
+}
 
 SKIP: {
 	require_mods(qw(DBD::SQLite Search::Xapian::WritableDatabase), 2);