progrium/sshcommand — pull request #8 by stuartpb (2014-02-18 09:08:21+00:00)
Title: Quote $SSH_ORIGINAL_COMMAND in key prefix

I'm not terribly well-versed in Bash, but if I'm not mistaken, the unquoted version allows users to do something like this to execute arbitrary commands:

`ssh dokku@progriumapps.com "version; rm -rf /"`

whereas the quoted version triggers some kind of escaping logic that prevents that from happening.