The branch main has been updated by dteske: URL: https://cgit.FreeBSD.org/src/commit/?id=4aeab132f6d8f38f5434315db22dbeb3072e5d2c
commit 4aeab132f6d8f38f5434315db22dbeb3072e5d2c Author: Devin Teske <[email protected]> AuthorDate: 2026-09-02 01:38:44 +0000 Commit: Devin Teske <[email protected]> CommitDate: 2026-09-02 01:38:44 +0000 git-arc: SC2223 DoS-via-glob hardening Quote LOCALBASE and ARC_CMD default assignments so a poisoned value cannot glob into :'s argv. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D59130 --- tools/tools/git/git-arc.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/tools/git/git-arc.sh b/tools/tools/git/git-arc.sh index e7ca3fabd63f..efc29b92865d 100755 --- a/tools/tools/git/git-arc.sh +++ b/tools/tools/git/git-arc.sh @@ -152,9 +152,9 @@ setup() # the devel/arcanist-port, which installs a symlink in ${LOCALBASE}/bin # but conflicts with the archivers/arc port. # -: ${LOCALBASE:=$(sysctl -n user.localbase)} -: ${LOCALBASE:=/usr/local} -: ${ARC_CMD:=${LOCALBASE}/lib/php/arcanist/bin/arc} +: "${LOCALBASE:=$(sysctl -n user.localbase)}" +: "${LOCALBASE:=/usr/local}" +: "${ARC_CMD:=${LOCALBASE}/lib/php/arcanist/bin/arc}" arc() { ${ARC_CMD} "$@"
