SC2046: Quote this to prevent word splitting.

When command expansions are unquoted, word splitting and globbing will
occur. This often manifests itself by breaking when filenames contain
spaces.

Trying to fix it by adding quotes or escapes to the data will not work.
Instead, quote the command substitution itself.

If the command substitution outputs multiple pieces of data, use a loop
instead.

Add an exception when using set -- where splitting is intended.

PR:             227109
Submitted by:   mat
Exp-run by:	antoine
Sponsored by:   Absolight

5 files changed, 9 insertions, 5 deletions

diff --git a/Mk/Scripts/check_leftovers.sh b/Mk/Scripts/check_leftovers.sh
index 9e4afd1ca670..78ae38beda74 100644
--- a/Mk/Scripts/check_leftovers.sh
+++ b/Mk/Scripts/check_leftovers.sh
@@ -45,7 +45,7 @@ fi
 if [ -z "${CCACHE_DIR}" ]; then
 	CCACHE_DIR=$(make -C ${portdir} -VCCACHE_DIR)
 fi
-homedirs=$(awk -F: -v users=$(make -C ${portdir} -V USERS|sed -e 's, ,|,g;/^$/d;s,^,^(,;s,$,)$,') 'users && $1 ~ users {print $9}' ${PORTSDIR}/UIDs|sort -u|sed -e "s|/usr/local|${PREFIX}|"|tr "\n" " ")
+homedirs=$(awk -F: -v users="$(make -C ${portdir} -V USERS|sed -e 's, ,|,g;/^$/d;s,^,^(,;s,$,)$,')" 'users && $1 ~ users {print $9}' ${PORTSDIR}/UIDs|sort -u|sed -e "s|/usr/local|${PREFIX}|"|tr "\n" " ")
 plistsub_sed=$(make -C ${portdir} -VPLIST_SUB_SED | /bin/sh ${PORTSDIR}/Mk/Scripts/plist_sub_sed_sort.sh)
 tmpplist=$(make -C ${portdir} -VTMPPLIST)
 
diff --git a/Mk/Scripts/depends-list.sh b/Mk/Scripts/depends-list.sh
index 91d95d136e7e..ce4f4b75a094 100644
--- a/Mk/Scripts/depends-list.sh
+++ b/Mk/Scripts/depends-list.sh
@@ -101,10 +101,14 @@ check_dep() {
 		# Grab any needed vars from the port.
 
 		if [ ${requires_wrkdir} -eq 1 ]; then
+			# shellcheck disable=SC2046
+			# We want word splitting here.
 			set -- $(${dp_MAKE} -C ${d} -VWRKDIR -V_UNIFIED_DEPENDS)
 			wrkdir="$1"
 			shift
 		elif [ ${recursive} -eq 1 ]; then
+			# shellcheck disable=SC2046
+			# We want word splitting here.
 			set -- $(${dp_MAKE} -C ${d} -V_UNIFIED_DEPENDS)
 		fi
 
diff --git a/Mk/Scripts/find-lib.sh b/Mk/Scripts/find-lib.sh
index 80c830ac14fa..6f96005a3a88 100644
--- a/Mk/Scripts/find-lib.sh
+++ b/Mk/Scripts/find-lib.sh
@@ -27,7 +27,7 @@ dirs="${LIB_DIRS} $(cat ${LOCALBASE}/libdata/ldconfig/* 2>/dev/null || :)"
 for libdir in ${dirs} ; do
 	test -f ${libdir}/${lib} || continue
 	libfile=${libdir}/${lib}
-	[ $(file -b -L --mime-type ${libfile}) = "application/x-sharedlib" ] || continue
+	[ "$(file -b -L --mime-type ${libfile})" = "application/x-sharedlib" ] || continue
 	echo $libfile
 	break
 done
diff --git a/Mk/Scripts/functions.sh b/Mk/Scripts/functions.sh
index 72ee5c3fe69e..20affc692b03 100644
--- a/Mk/Scripts/functions.sh
+++ b/Mk/Scripts/functions.sh
@@ -188,8 +188,8 @@ export_ports_env() {
 	done
 
 	# Bring in all the vars, but not empty ones.
-	eval $(${MAKE} -f ${PORTSDIR}/Mk/bsd.port.mk ${make_cmd} \
-	    USES="${uses}" | grep -v '=$' | sed -e 's,\\ $,,')
+	eval "$(${MAKE} -f ${PORTSDIR}/Mk/bsd.port.mk ${make_cmd} \
+		USES="${uses}" | grep -v '=$' | sed -e 's,\\ $,,')"
 	for var in ${export_vars}; do
 		# Export and display non-empty ones.  This is not redundant
 		# with above since we're looping on all vars here; do not
diff --git a/Mk/Scripts/smart_makepatch.sh b/Mk/Scripts/smart_makepatch.sh
index b594e4590a4c..5f39189d194c 100644
--- a/Mk/Scripts/smart_makepatch.sh
+++ b/Mk/Scripts/smart_makepatch.sh
@@ -63,7 +63,7 @@ std_patch_filename() {
 	local raw_name
 	sans_cwd=$(echo $1 | sed 's|^\.\/||')
 	raw_name=$(strip_path ${sans_cwd})
-	echo patch-$(echo ${raw_name} | sed -e 's|_|&&|g; s|/|_|g')
+	echo "patch-$(echo ${raw_name} | sed -e 's|_|&&|g; s|/|_|g')"
 }
 
 patchdir_files_list() {