Re: [PATCH] git-sh-setup.sh: fix missing double quotes variables
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Jun 19, 2016, 03:16 UTC
- Message-ID
- <xmqqinx5yijm.fsf@gitster.mtv.corp.google.com>
- In-Reply-To
- <20160619024554.2983-1-cuong.manhle.vn@gmail.com>
LE Manh Cuong <cuong.manhle.vn@gmail.com> writes:
Show 6 quoted lines
> It's not only people shooting their foot, but also from malicious user. > Given that `curl url | sudo sh/bash` is often found in many instructions, > an end user may not be noticed about the environment variable injection > from their side. > > IMHO, it's better if git can protect the end users in this situation.
Huh? For those who run `curl url | sudo sh`, I do not think the incoming script setting and exporting LV to an arbitrary value and runing Git is not the top thing they need worry about.
While I think enclosing the string in dq is an improvement (as I said already), I still do think your use of the v-word is making a mountain out of an anthill.