Linux – Setting Environment Variables in Remote Bash Shells Spawned with SSH

I now have a working model for all characters except \n:

sub shell_quote_scalar {
    # Quote the string so shell will not expand any special chars
    # Returns:
    #   string quoted with \ as needed by the shell
    my $a = shift;
    $a =~ s/([\002-\011\013-\032\\\#\?\`\(\)\{\}\[\]\*\>\<\~\|\; \"\!\$\&\'\202-\377])/\\$1/g;
    $a =~ s/[\n]/'\n'/g; # filenames with '\n' is quoted using \'
    return $a;
}

sub env_quote {
    my $v = shift;
    $v =~ s/([ \n\&\<\>\(\)\;\'\{\}\t\"\$\`\*\174\!\?\~])/\\$1/g;
    return $v;
}

my @qcsh = map { my $a=$_; "setenv $a " . env_quote($ENV{$a})  } @vars;
my @qbash = map { my $a=$_; "export $a=" . env_quote($ENV{$a}) } @vars;

$Global::envvar =
    join"",
    (q{echo $SHELL | grep -E "/t?csh" > /dev/null && }
     . join(" && ", @qcsh)
     . q{ || }
     . join(" && ", @qbash)
     .q{;});

print shell_quote_scalar($Global::envvar);

Possible solution:

As I was typing the question I came up with a solution. But it seems to me there must be a simpler and more secure solution to this problem. What I did was change the value of 'command' in the authorized_keys file to:

command="~/somescript.sh" 

And 'somescript.sh' contains:

#!/bin/bash
ALLOW=(
    '/home/<user>/repository1.git'
    '/home/<user>/repository2.git'
)

case $SSH_ORIGINAL_COMMAND in
    "git-receive-pack"*|"git-upload-pack"*|"git-upload-archive"*)
        GITPATH=$(echo $SSH_ORIGINAL_COMMAND | sed -r "s:.*'([^']*)'.*:\1:g")
        ALLOWED="false"
        for ((i=0; i < ${#ALLOW[@]}; i++)); do
            if [ "${ALLOW[$i]}" == "$GITPATH" ]; then
                ALLOWED="true"; break;
            fi
        done

        if [ "$ALLOWED" == "true" ]; then
            eval "git-shell -c \"$SSH_ORIGINAL_COMMAND\""
        else
            echo "[ERROR] ACCESS DENIED" >&2
            exit 1
        fi
        ;;
    *)
        echo "[ERROR] Only git commands are allowed!" >&2
        exit 1
        ;;
esac

In the script I'm taking advantage of the fact that the commands git clone, git push and git pull produce on the REMOTE side:

git-upload-pack '<path>/<to>/<repository>', or
git-receive-pack '<path>/<to>/<repository>'

I specify repositories in variable ALLOW that are allowed to be accessed through the ssh key that uses the script, and simply compare them to the path specified in the issued git command (variable GITPATH). There is a security risk though, when multiple git commands are issued in one line. If the command contains at least one mention of an allowed repository, it executes the entire command. Any suggestions on improvement?