From: Junio C Hamano Date: Sun, 19 Jun 2016 03:16:45 GMT Subject: Re: [PATCH] git-sh-setup.sh: fix missing double quotes variables Message-ID: In-Reply-To: <20160619024554.2983-1-cuong.manhle.vn@gmail.com> LE Manh Cuong writes: > It's not only people shooting their foot, but also from malicious user. > Given that `curl url | sudo sh/bash` is often found in many instructions, > an end user may not be noticed about the environment variable injection > from their side. > > IMHO, it's better if git can protect the end users in this situation. Huh? For those who run `curl url | sudo sh`, I do not think the incoming script setting and exporting LV to an arbitrary value and runing Git is not the top thing they need worry about. While I think enclosing the string in dq is an improvement (as I said already), I still do think your use of the v-word is making a mountain out of an anthill.