git: 4aeab132f6d8 - main - git-arc: SC2223 DoS-via-glob hardening

The branch main has been updated by dteske:

URL: https://cgit.FreeBSD.org/src/commit/?id=4aeab132f6d8f38f5434315db22dbeb3072e5d2c

commit 4aeab132f6d8f38f5434315db22dbeb3072e5d2c
Author:     Devin Teske <dteske@FreeBSD.org>
AuthorDate: 2026-09-02 01:38:44 +0000
Commit:     Devin Teske <dteske@FreeBSD.org>
CommitDate: 2026-09-02 01:38:44 +0000

    git-arc: SC2223 DoS-via-glob hardening
    
    Quote LOCALBASE and ARC_CMD default assignments so a poisoned
    value cannot glob into :'s argv.
    
    Reviewed by:    markj
    Differential Revision:  https://reviews.freebsd.org/D59130
---
 tools/tools/git/git-arc.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/tools/git/git-arc.sh b/tools/tools/git/git-arc.sh
index e7ca3fabd63f..efc29b92865d 100755
--- a/tools/tools/git/git-arc.sh
+++ b/tools/tools/git/git-arc.sh
@@ -152,9 +152,9 @@ setup()
 # the devel/arcanist-port, which installs a symlink in ${LOCALBASE}/bin
 # but conflicts with the archivers/arc port.
 #
-: ${LOCALBASE:=$(sysctl -n user.localbase)}
-: ${LOCALBASE:=/usr/local}
-: ${ARC_CMD:=${LOCALBASE}/lib/php/arcanist/bin/arc}
+: "${LOCALBASE:=$(sysctl -n user.localbase)}"
+: "${LOCALBASE:=/usr/local}"
+: "${ARC_CMD:=${LOCALBASE}/lib/php/arcanist/bin/arc}"
 arc()
 {
     ${ARC_CMD} "$@"