diff --git a/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php
index 0b6ae19e32..477a89c88b 100644
--- a/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php
@@ -1,548 +1,549 @@
 <?php
 
 final class DiffusionBrowseQueryConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'diffusion.browsequery';
   }
 
   public function getMethodDescription() {
     return pht(
       'File(s) information for a repository at an (optional) path and '.
       '(optional) commit.');
   }
 
   protected function defineReturnType() {
     return 'array';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'path' => 'optional string',
       'commit' => 'optional string',
       'needValidityOnly' => 'optional bool',
       'limit' => 'optional int',
       'offset' => 'optional int',
     );
   }
 
   protected function getResult(ConduitAPIRequest $request) {
     $result = parent::getResult($request);
     return $result->toDictionary();
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $path = $request->getValue('path');
     $commit = $request->getValue('commit');
     $offset = (int)$request->getValue('offset');
     $limit = (int)$request->getValue('limit');
     $result = $this->getEmptyResultSet();
 
     if ($path == '') {
       // Fast path to improve the performance of the repository view; we know
       // the root is always a tree at any commit and always exists.
       $stdout = 'tree';
     } else {
       try {
         list($stdout) = $repository->execxLocalCommand(
-          'cat-file -t %s:%s',
+          'cat-file -t -- %s:%s',
           $commit,
           $path);
       } catch (CommandException $e) {
         // The "cat-file" command may fail if the path legitimately does not
         // exist, but it may also fail if the path is a submodule. This can
         // produce either "Not a valid object name" or "could not get object
         // info".
 
         // To detect if we have a submodule, use `git ls-tree`. If the path
         // is a submodule, we'll get a "160000" mode mask with type "commit".
 
         list($sub_err, $sub_stdout) = $repository->execLocalCommand(
           'ls-tree %s -- %s',
-          $commit,
+          gitsprintf('%s', $commit),
           $path);
         if (!$sub_err) {
           // If the path failed "cat-file" but "ls-tree" worked, we assume it
           // must be a submodule. If it is, the output will look something
           // like this:
           //
           //   160000 commit <hash> <path>
           //
           // We make sure it has the 160000 mode mask to confirm that it's
           // definitely a submodule.
           $mode = (int)$sub_stdout;
           if ($mode & 160000) {
             $submodule_reason = DiffusionBrowseResultSet::REASON_IS_SUBMODULE;
             $result
               ->setReasonForEmptyResultSet($submodule_reason);
             return $result;
           }
         }
 
         $stderr = $e->getStderr();
         if (preg_match('/^fatal: Not a valid object name/', $stderr)) {
           // Grab two logs, since the first one is when the object was deleted.
           list($stdout) = $repository->execxLocalCommand(
-            'log -n2 --format="%%H" %s -- %s',
-            $commit,
+            'log -n2 %s %s -- %s',
+            '--format=%H',
+            gitsprintf('%s', $commit),
             $path);
           $stdout = trim($stdout);
           if ($stdout) {
             $commits = explode("\n", $stdout);
             $result
               ->setReasonForEmptyResultSet(
                 DiffusionBrowseResultSet::REASON_IS_DELETED)
               ->setDeletedAtCommit(idx($commits, 0))
               ->setExistedAtCommit(idx($commits, 1));
             return $result;
           }
 
           $result->setReasonForEmptyResultSet(
             DiffusionBrowseResultSet::REASON_IS_NONEXISTENT);
           return $result;
         } else {
           throw $e;
         }
       }
     }
 
     if (trim($stdout) == 'blob') {
       $result->setReasonForEmptyResultSet(
         DiffusionBrowseResultSet::REASON_IS_FILE);
       return $result;
     }
 
     $result->setIsValidResults(true);
     if ($this->shouldOnlyTestValidity($request)) {
       return $result;
     }
 
     list($stdout) = $repository->execxLocalCommand(
-      'ls-tree -z -l %s:%s',
-      $commit,
+      'ls-tree -z -l %s -- %s',
+      gitsprintf('%s', $commit),
       $path);
 
     $submodules = array();
 
     if (strlen($path)) {
       $prefix = rtrim($path, '/').'/';
     } else {
       $prefix = '';
     }
 
     $count = 0;
     $results = array();
     $lines = empty($stdout)
            ? array()
            : explode("\0", rtrim($stdout));
 
     foreach ($lines as $line) {
       // NOTE: Limit to 5 components so we parse filenames with spaces in them
       // correctly.
       // NOTE: The output uses a mixture of tabs and one-or-more spaces to
       // delimit fields.
       $parts = preg_split('/\s+/', $line, 5);
       if (count($parts) < 5) {
         throw new Exception(
           pht(
             'Expected "<mode> <type> <hash> <size>\t<name>", for ls-tree of '.
             '"%s:%s", got: %s',
             $commit,
             $path,
             $line));
       }
 
       list($mode, $type, $hash, $size, $name) = $parts;
 
       $path_result = new DiffusionRepositoryPath();
 
       if ($type == 'tree') {
         $file_type = DifferentialChangeType::FILE_DIRECTORY;
       } else if ($type == 'commit') {
         $file_type = DifferentialChangeType::FILE_SUBMODULE;
         $submodules[] = $path_result;
       } else {
         $mode = intval($mode, 8);
         if (($mode & 0120000) == 0120000) {
           $file_type = DifferentialChangeType::FILE_SYMLINK;
         } else {
           $file_type = DifferentialChangeType::FILE_NORMAL;
         }
       }
 
       $path_result->setFullPath($prefix.$name);
       $path_result->setPath($name);
       $path_result->setHash($hash);
       $path_result->setFileType($file_type);
       $path_result->setFileSize($size);
 
       if ($count >= $offset) {
         $results[] = $path_result;
       }
 
       $count++;
 
       if ($limit && $count >= ($offset + $limit)) {
         break;
       }
     }
 
     // If we identified submodules, lookup the module info at this commit to
     // find their source URIs.
 
     if ($submodules) {
 
       // NOTE: We need to read the file out of git and write it to a temporary
       // location because "git config -f" doesn't accept a "commit:path"-style
       // argument.
 
       // NOTE: This file may not exist, e.g. because the commit author removed
       // it when they added the submodule. See T1448. If it's not present, just
       // show the submodule without enriching it. If ".gitmodules" was removed
       // it seems to partially break submodules, but the repository as a whole
       // continues to work fine and we've seen at least two cases of this in
       // the wild.
 
       list($err, $contents) = $repository->execLocalCommand(
-        'cat-file blob %s:.gitmodules',
+        'cat-file blob -- %s:.gitmodules',
         $commit);
 
       if (!$err) {
         $tmp = new TempFile();
         Filesystem::writeFile($tmp, $contents);
         list($module_info) = $repository->execxLocalCommand(
           'config -l -f %s',
           $tmp);
 
         $dict = array();
         $lines = explode("\n", trim($module_info));
         foreach ($lines as $line) {
           list($key, $value) = explode('=', $line, 2);
           $parts = explode('.', $key);
           $dict[$key] = $value;
         }
 
         foreach ($submodules as $path) {
           $full_path = $path->getFullPath();
           $key = 'submodule.'.$full_path.'.url';
           if (isset($dict[$key])) {
             $path->setExternalURI($dict[$key]);
           }
         }
       }
     }
 
     return $result->setPaths($results);
   }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $path = $request->getValue('path');
     $commit = $request->getValue('commit');
     $offset = (int)$request->getValue('offset');
     $limit = (int)$request->getValue('limit');
     $result = $this->getEmptyResultSet();
 
 
     $entire_manifest = id(new DiffusionLowLevelMercurialPathsQuery())
       ->setRepository($repository)
       ->withCommit($commit)
       ->withPath($path)
       ->execute();
 
     $results = array();
 
     $match_against = trim($path, '/');
     $match_len = strlen($match_against);
 
     // For the root, don't trim. For other paths, trim the "/" after we match.
     // We need this because Mercurial's canonical paths have no leading "/",
     // but ours do.
     $trim_len = $match_len ? $match_len + 1 : 0;
 
     $count = 0;
     foreach ($entire_manifest as $path) {
       if (strncmp($path, $match_against, $match_len)) {
         continue;
       }
       if (!strlen($path)) {
         continue;
       }
       $remainder = substr($path, $trim_len);
       if (!strlen($remainder)) {
         // There is a file with this exact name in the manifest, so clearly
         // it's a file.
         $result->setReasonForEmptyResultSet(
           DiffusionBrowseResultSet::REASON_IS_FILE);
         return $result;
       }
 
       $parts = explode('/', $remainder);
       $name = reset($parts);
 
       // If we've already seen this path component, we're looking at a file
       // inside a directory we already processed. Just move on.
       if (isset($results[$name])) {
         continue;
       }
 
       if (count($parts) == 1) {
         $type = DifferentialChangeType::FILE_NORMAL;
       } else {
         $type = DifferentialChangeType::FILE_DIRECTORY;
       }
 
       if ($count >= $offset) {
         $results[$name] = $type;
       }
 
       $count++;
 
       if ($limit && ($count >= ($offset + $limit))) {
         break;
       }
     }
 
     foreach ($results as $key => $type) {
       $path_result = new DiffusionRepositoryPath();
       $path_result->setPath($key);
       $path_result->setFileType($type);
       $path_result->setFullPath(ltrim($match_against.'/', '/').$key);
 
       $results[$key] = $path_result;
     }
 
     $valid_results = true;
     if (empty($results)) {
       // TODO: Detect "deleted" by issuing "hg log"?
       $result->setReasonForEmptyResultSet(
         DiffusionBrowseResultSet::REASON_IS_NONEXISTENT);
       $valid_results = false;
     }
 
     return $result
       ->setPaths($results)
       ->setIsValidResults($valid_results);
   }
 
   protected function getSVNResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $path = $request->getValue('path');
     $commit = $request->getValue('commit');
     $offset = (int)$request->getValue('offset');
     $limit = (int)$request->getValue('limit');
     $result = $this->getEmptyResultSet();
 
     $subpath = $repository->getDetail('svn-subpath');
     if ($subpath && strncmp($subpath, $path, strlen($subpath))) {
       // If we have a subpath and the path isn't a child of it, it (almost
       // certainly) won't exist since we don't track commits which affect
       // it. (Even if it exists, return a consistent result.)
       $result->setReasonForEmptyResultSet(
         DiffusionBrowseResultSet::REASON_IS_UNTRACKED_PARENT);
       return $result;
     }
 
     $conn_r = $repository->establishConnection('r');
 
     $parent_path = DiffusionPathIDQuery::getParentPath($path);
     $path_query = new DiffusionPathIDQuery(
       array(
         $path,
         $parent_path,
       ));
     $path_map = $path_query->loadPathIDs();
 
     $path_id = $path_map[$path];
     $parent_path_id = $path_map[$parent_path];
 
     if (empty($path_id)) {
       $result->setReasonForEmptyResultSet(
         DiffusionBrowseResultSet::REASON_IS_NONEXISTENT);
       return $result;
     }
 
     if ($commit) {
       $slice_clause = qsprintf($conn_r, 'AND svnCommit <= %d', $commit);
     } else {
       $slice_clause = qsprintf($conn_r, '');
     }
 
     $index = queryfx_all(
       $conn_r,
       'SELECT pathID, max(svnCommit) maxCommit FROM %T WHERE
         repositoryID = %d AND parentID = %d
         %Q GROUP BY pathID',
       PhabricatorRepository::TABLE_FILESYSTEM,
       $repository->getID(),
       $path_id,
       $slice_clause);
 
     if (!$index) {
       if ($path == '/') {
         $result->setReasonForEmptyResultSet(
           DiffusionBrowseResultSet::REASON_IS_EMPTY);
       } else {
 
         // NOTE: The parent path ID is included so this query can take
         // advantage of the table's primary key; it is uniquely determined by
         // the pathID but if we don't do the lookup ourselves MySQL doesn't have
         // the information it needs to avoid a table scan.
 
         $reasons = queryfx_all(
           $conn_r,
           'SELECT * FROM %T WHERE repositoryID = %d
               AND parentID = %d
               AND pathID = %d
             %Q ORDER BY svnCommit DESC LIMIT 2',
           PhabricatorRepository::TABLE_FILESYSTEM,
           $repository->getID(),
           $parent_path_id,
           $path_id,
           $slice_clause);
 
         $reason = reset($reasons);
 
         if (!$reason) {
           $result->setReasonForEmptyResultSet(
             DiffusionBrowseResultSet::REASON_IS_NONEXISTENT);
         } else {
           $file_type = $reason['fileType'];
           if (empty($reason['existed'])) {
             $result->setReasonForEmptyResultSet(
               DiffusionBrowseResultSet::REASON_IS_DELETED);
             $result->setDeletedAtCommit($reason['svnCommit']);
             if (!empty($reasons[1])) {
               $result->setExistedAtCommit($reasons[1]['svnCommit']);
             }
           } else if ($file_type == DifferentialChangeType::FILE_DIRECTORY) {
             $result->setReasonForEmptyResultSet(
               DiffusionBrowseResultSet::REASON_IS_EMPTY);
           } else {
             $result->setReasonForEmptyResultSet(
               DiffusionBrowseResultSet::REASON_IS_FILE);
           }
         }
       }
       return $result;
     }
 
     $result->setIsValidResults(true);
     if ($this->shouldOnlyTestValidity($request)) {
       return $result;
     }
 
     $sql = array();
     foreach ($index as $row) {
       $sql[] = qsprintf(
         $conn_r,
         '(pathID = %d AND svnCommit = %d)',
         $row['pathID'],
         $row['maxCommit']);
     }
 
     $browse = queryfx_all(
       $conn_r,
       'SELECT *, p.path pathName
         FROM %T f JOIN %T p ON f.pathID = p.id
         WHERE repositoryID = %d
           AND parentID = %d
           AND existed = 1
         AND (%LO)
         ORDER BY pathName',
       PhabricatorRepository::TABLE_FILESYSTEM,
       PhabricatorRepository::TABLE_PATH,
       $repository->getID(),
       $path_id,
       $sql);
 
     $loadable_commits = array();
     foreach ($browse as $key => $file) {
       // We need to strip out directories because we don't store last-modified
       // in the filesystem table.
       if ($file['fileType'] != DifferentialChangeType::FILE_DIRECTORY) {
         $loadable_commits[] = $file['svnCommit'];
         $browse[$key]['hasCommit'] = true;
       }
     }
 
     $commits = array();
     $commit_data = array();
     if ($loadable_commits) {
       // NOTE: Even though these are integers, use '%Ls' because MySQL doesn't
       // use the second part of the key otherwise!
       $commits = id(new PhabricatorRepositoryCommit())->loadAllWhere(
         'repositoryID = %d AND commitIdentifier IN (%Ls)',
         $repository->getID(),
         $loadable_commits);
       $commits = mpull($commits, null, 'getCommitIdentifier');
       if ($commits) {
         $commit_data = id(new PhabricatorRepositoryCommitData())->loadAllWhere(
           'commitID in (%Ld)',
           mpull($commits, 'getID'));
         $commit_data = mpull($commit_data, null, 'getCommitID');
       } else {
         $commit_data = array();
       }
     }
 
     $path_normal = DiffusionPathIDQuery::normalizePath($path);
 
     $results = array();
     $count = 0;
     foreach ($browse as $file) {
 
       $full_path = $file['pathName'];
       $file_path = ltrim(substr($full_path, strlen($path_normal)), '/');
       $full_path = ltrim($full_path, '/');
 
       $result_path = new DiffusionRepositoryPath();
       $result_path->setPath($file_path);
       $result_path->setFullPath($full_path);
       $result_path->setFileType($file['fileType']);
 
       if (!empty($file['hasCommit'])) {
         $commit = idx($commits, $file['svnCommit']);
         if ($commit) {
           $data = idx($commit_data, $commit->getID());
           $result_path->setLastModifiedCommit($commit);
           $result_path->setLastCommitData($data);
         }
       }
 
       if ($count >= $offset) {
         $results[] = $result_path;
       }
 
       $count++;
 
       if ($limit && ($count >= ($offset + $limit))) {
         break;
       }
     }
 
     if (empty($results)) {
       $result->setReasonForEmptyResultSet(
         DiffusionBrowseResultSet::REASON_IS_EMPTY);
     }
 
     return $result->setPaths($results);
   }
 
   private function getEmptyResultSet() {
     return id(new DiffusionBrowseResultSet())
       ->setPaths(array())
       ->setReasonForEmptyResultSet(null)
       ->setIsValidResults(false);
   }
 
   private function shouldOnlyTestValidity(ConduitAPIRequest $request) {
     return $request->getValue('needValidityOnly', false);
   }
 
 }
diff --git a/src/applications/diffusion/conduit/DiffusionExistsQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionExistsQueryConduitAPIMethod.php
index 2d4a221171..7a7dbff598 100644
--- a/src/applications/diffusion/conduit/DiffusionExistsQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionExistsQueryConduitAPIMethod.php
@@ -1,54 +1,54 @@
 <?php
 
 final class DiffusionExistsQueryConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'diffusion.existsquery';
   }
 
   public function getMethodDescription() {
     return pht('Determine if code exists in a version control system.');
   }
 
   protected function defineReturnType() {
     return 'bool';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'commit' => 'required string',
     );
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $repository = $this->getDiffusionRequest()->getRepository();
     $commit = $request->getValue('commit');
     list($err, $merge_base) = $repository->execLocalCommand(
-      'cat-file -t %s',
+      'cat-file -t -- %s',
       $commit);
     return !$err;
   }
 
   protected function getSVNResult(ConduitAPIRequest $request) {
     $repository = $this->getDiffusionRequest()->getRepository();
     $commit = $request->getValue('commit');
 
     $refs = id(new DiffusionCachedResolveRefsQuery())
       ->setRepository($repository)
       ->withRefs(array($commit))
       ->execute();
 
     return (bool)$refs;
   }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $repository = $this->getDiffusionRequest()->getRepository();
     $commit = $request->getValue('commit');
     list($err, $stdout) = $repository->execLocalCommand(
       'id --rev %s',
       hgsprintf('%s', $commit));
     return !$err;
   }
 
 }
diff --git a/src/applications/diffusion/conduit/DiffusionHistoryQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionHistoryQueryConduitAPIMethod.php
index ebce21dd6f..223aef6a7d 100644
--- a/src/applications/diffusion/conduit/DiffusionHistoryQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionHistoryQueryConduitAPIMethod.php
@@ -1,286 +1,286 @@
 <?php
 
 final class DiffusionHistoryQueryConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   private $parents = array();
 
   public function getAPIMethodName() {
     return 'diffusion.historyquery';
   }
 
   public function getMethodDescription() {
     return pht(
       'Returns history information for a repository at a specific '.
       'commit and path.');
   }
 
   protected function defineReturnType() {
     return 'array';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'commit' => 'required string',
       'against' => 'optional string',
       'path' => 'required string',
       'offset' => 'required int',
       'limit' => 'required int',
       'needDirectChanges' => 'optional bool',
       'needChildChanges' => 'optional bool',
     );
   }
 
   protected function getResult(ConduitAPIRequest $request) {
     $path_changes = parent::getResult($request);
 
     return array(
       'pathChanges' => mpull($path_changes, 'toDictionary'),
       'parents' => $this->parents,
     );
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $commit_hash = $request->getValue('commit');
     $against_hash = $request->getValue('against');
     $path = $request->getValue('path');
     $offset = $request->getValue('offset');
     $limit = $request->getValue('limit');
 
     if (strlen($against_hash)) {
       $commit_range = "${against_hash}..${commit_hash}";
     } else {
       $commit_range = $commit_hash;
     }
 
     list($stdout) = $repository->execxLocalCommand(
       'log '.
         '--skip=%d '.
         '-n %d '.
         '--pretty=format:%s '.
         '%s -- %C',
       $offset,
       $limit,
       '%H:%P',
-      $commit_range,
+      gitsprintf('%s', $commit_range),
       // Git omits merge commits if the path is provided, even if it is empty.
       (strlen($path) ? csprintf('%s', $path) : ''));
 
     $lines = explode("\n", trim($stdout));
     $lines = array_filter($lines);
 
     $hash_list = array();
     $parent_map = array();
     foreach ($lines as $line) {
       list($hash, $parents) = explode(':', $line);
       $hash_list[] = $hash;
       $parent_map[$hash] = preg_split('/\s+/', $parents);
     }
 
     $this->parents = $parent_map;
 
     if (!$hash_list) {
       return array();
     }
 
     return DiffusionQuery::loadHistoryForCommitIdentifiers(
       $hash_list,
       $drequest);
   }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $commit_hash = $request->getValue('commit');
     $path = $request->getValue('path');
     $offset = $request->getValue('offset');
     $limit = $request->getValue('limit');
 
     $path = DiffusionPathIDQuery::normalizePath($path);
     $path = ltrim($path, '/');
 
     // NOTE: Older versions of Mercurial give different results for these
     // commands (see T1268):
     //
     //   $ hg log -- ''
     //   $ hg log
     //
     // All versions of Mercurial give different results for these commands
     // (merge commits are excluded with the "." version):
     //
     //   $ hg log -- .
     //   $ hg log
     //
     // If we don't have a path component in the query, omit it from the command
     // entirely to avoid these inconsistencies.
 
     // NOTE: When viewing the history of a file, we don't use "-b", because
     // Mercurial stops history at the branchpoint but we're interested in all
     // ancestors. When viewing history of a branch, we do use "-b", and thus
     // stop history (this is more consistent with the Mercurial worldview of
     // branches).
 
     if (strlen($path)) {
       $path_arg = csprintf('%s', $path);
       $revset_arg = hgsprintf(
         'reverse(ancestors(%s))',
         $commit_hash);
     } else {
       $path_arg = '';
       $revset_arg = hgsprintf(
         'reverse(ancestors(%s)) and branch(%s)',
         $drequest->getBranch(),
         $commit_hash);
     }
 
     list($stdout) = $repository->execxLocalCommand(
       'log --debug --template %s --limit %d --rev %s -- %C',
       '{node};{parents}\\n',
       ($offset + $limit), // No '--skip' in Mercurial.
       $revset_arg,
       $path_arg);
 
     $stdout = DiffusionMercurialCommandEngine::filterMercurialDebugOutput(
       $stdout);
     $lines = explode("\n", trim($stdout));
     $lines = array_slice($lines, $offset);
 
     $hash_list = array();
     $parent_map = array();
 
     $last = null;
     foreach (array_reverse($lines) as $line) {
       list($hash, $parents) = explode(';', $line);
       $parents = trim($parents);
       if (!$parents) {
         if ($last === null) {
           $parent_map[$hash] = array('...');
         } else {
           $parent_map[$hash] = array($last);
         }
       } else {
         $parents = preg_split('/\s+/', $parents);
         foreach ($parents as $parent) {
           list($plocal, $phash) = explode(':', $parent);
           if (!preg_match('/^0+$/', $phash)) {
             $parent_map[$hash][] = $phash;
           }
         }
         // This may happen for the zeroth commit in repository, both hashes
         // are "000000000...".
         if (empty($parent_map[$hash])) {
           $parent_map[$hash] = array('...');
         }
       }
 
       // The rendering code expects the first commit to be "mainline", like
       // Git. Flip the order so it does the right thing.
       $parent_map[$hash] = array_reverse($parent_map[$hash]);
 
       $hash_list[] = $hash;
       $last = $hash;
     }
 
     $hash_list = array_reverse($hash_list);
     $this->parents = array_reverse($parent_map, true);
 
     return DiffusionQuery::loadHistoryForCommitIdentifiers(
       $hash_list,
       $drequest);
   }
 
   protected function getSVNResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $commit = $request->getValue('commit');
     $path = $request->getValue('path');
     $offset = $request->getValue('offset');
     $limit = $request->getValue('limit');
     $need_direct_changes = $request->getValue('needDirectChanges');
     $need_child_changes = $request->getValue('needChildChanges');
 
     $conn_r = $repository->establishConnection('r');
 
     $paths = queryfx_all(
       $conn_r,
       'SELECT id, path FROM %T WHERE pathHash IN (%Ls)',
       PhabricatorRepository::TABLE_PATH,
       array(md5('/'.trim($path, '/'))));
     $paths = ipull($paths, 'id', 'path');
     $path_id = idx($paths, '/'.trim($path, '/'));
 
     if (!$path_id) {
       return array();
     }
 
     $filter_query = qsprintf($conn_r, '');
     if ($need_direct_changes) {
       if ($need_child_changes) {
         $filter_query = qsprintf(
           $conn_r,
           'AND (isDirect = 1 OR changeType = %s)',
           DifferentialChangeType::TYPE_CHILD);
       } else {
         $filter_query = qsprintf(
           $conn_r,
           'AND (isDirect = 1)');
       }
     }
 
     $history_data = queryfx_all(
       $conn_r,
       'SELECT * FROM %T WHERE repositoryID = %d AND pathID = %d
         AND commitSequence <= %d
         %Q
         ORDER BY commitSequence DESC
         LIMIT %d, %d',
       PhabricatorRepository::TABLE_PATHCHANGE,
       $repository->getID(),
       $path_id,
       $commit ? $commit : 0x7FFFFFFF,
       $filter_query,
       $offset,
       $limit);
 
     $commits = array();
     $commit_data = array();
 
     $commit_ids = ipull($history_data, 'commitID');
     if ($commit_ids) {
       $commits = id(new PhabricatorRepositoryCommit())->loadAllWhere(
         'id IN (%Ld)',
         $commit_ids);
       if ($commits) {
         $commit_data = id(new PhabricatorRepositoryCommitData())->loadAllWhere(
           'commitID in (%Ld)',
           $commit_ids);
         $commit_data = mpull($commit_data, null, 'getCommitID');
       }
     }
 
     $history = array();
     foreach ($history_data as $row) {
       $item = new DiffusionPathChange();
 
       $commit = idx($commits, $row['commitID']);
       if ($commit) {
         $item->setCommit($commit);
         $item->setCommitIdentifier($commit->getCommitIdentifier());
         $data = idx($commit_data, $commit->getID());
         if ($data) {
           $item->setCommitData($data);
         }
       }
 
       $item->setChangeType($row['changeType']);
       $item->setFileType($row['fileType']);
 
       $history[] = $item;
     }
 
     return $history;
   }
 
 }
diff --git a/src/applications/diffusion/conduit/DiffusionLastModifiedQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionLastModifiedQueryConduitAPIMethod.php
index 1135420a6e..a15000bd97 100644
--- a/src/applications/diffusion/conduit/DiffusionLastModifiedQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionLastModifiedQueryConduitAPIMethod.php
@@ -1,168 +1,168 @@
 <?php
 
 final class DiffusionLastModifiedQueryConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'diffusion.lastmodifiedquery';
   }
 
   public function getMethodDescription() {
     return pht('Get the commits at which paths were last modified.');
   }
 
   protected function defineReturnType() {
     return 'map<string, string>';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'paths' => 'required map<string, string>',
     );
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $paths = $request->getValue('paths');
     $results = $this->loadCommitsFromCache($paths);
 
     foreach ($paths as $path => $commit) {
       if (array_key_exists($path, $results)) {
         continue;
       }
       list($hash) = $repository->execxLocalCommand(
         'log -n1 --format=%%H %s -- %s',
-        $commit,
+        gitsprintf('%s', $commit),
         $path);
       $results[$path] = trim($hash);
     }
 
     return $results;
   }
 
   protected function getSVNResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $results = array();
     foreach ($request->getValue('paths') as $path => $commit) {
       $history_result = DiffusionQuery::callConduitWithDiffusionRequest(
         $request->getUser(),
         $drequest,
         'diffusion.historyquery',
         array(
           'commit' => $commit,
           'path' => $path,
           'limit' => 1,
           'offset' => 0,
           'needDirectChanges' => true,
           'needChildChanges' => true,
         ));
 
       $history_array = DiffusionPathChange::newFromConduit(
         $history_result['pathChanges']);
       if ($history_array) {
         $results[$path] = head($history_array)
           ->getCommit()
           ->getCommitIdentifier();
       }
     }
 
     return $results;
   }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $paths = $request->getValue('paths');
     $results = $this->loadCommitsFromCache($paths);
 
     foreach ($paths as $path => $commit) {
       if (array_key_exists($path, $results)) {
         continue;
       }
 
       list($hash) = $repository->execxLocalCommand(
         'log --template %s --limit 1 --removed --rev %s -- %s',
         '{node}',
         hgsprintf('reverse(ancestors(%s))',  $commit),
         nonempty(ltrim($path, '/'), '.'));
       $results[$path] = trim($hash);
     }
 
     return $results;
   }
 
   private function loadCommitsFromCache(array $map) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $path_map = id(new DiffusionPathIDQuery(array_keys($map)))
       ->loadPathIDs();
 
     $commit_query = id(new DiffusionCommitQuery())
       ->setViewer($drequest->getUser())
       ->withRepository($repository)
       ->withIdentifiers(array_values($map));
     $commit_query->execute();
 
     $commit_map = $commit_query->getIdentifierMap();
     $commit_map = mpull($commit_map, 'getID');
 
     $graph_cache = new PhabricatorRepositoryGraphCache();
 
     $results = array();
 
     // Spend no more than this many total seconds trying to satisfy queries
     // via the graph cache.
     $remaining_time = 10.0;
     foreach ($map as $path => $commit) {
       $path_id = idx($path_map, $path);
       if (!$path_id) {
         continue;
       }
       $commit_id = idx($commit_map, $commit);
       if (!$commit_id) {
         continue;
       }
 
       $t_start = microtime(true);
       $cache_result = $graph_cache->loadLastModifiedCommitID(
         $commit_id,
         $path_id,
         $remaining_time);
       $t_end = microtime(true);
 
       if ($cache_result !== false) {
         $results[$path] = $cache_result;
       }
 
       $remaining_time -= ($t_end - $t_start);
       if ($remaining_time <= 0) {
         break;
       }
     }
 
     if ($results) {
       $commits = id(new DiffusionCommitQuery())
         ->setViewer($drequest->getUser())
         ->withRepository($repository)
         ->withIDs($results)
         ->execute();
       foreach ($results as $path => $id) {
         $commit = idx($commits, $id);
         if ($commit) {
           $results[$path] = $commit->getCommitIdentifier();
         } else {
           unset($results[$path]);
         }
       }
     }
 
     return $results;
   }
 
 }
diff --git a/src/applications/diffusion/conduit/DiffusionMergedCommitsQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionMergedCommitsQueryConduitAPIMethod.php
index 79587a2e5e..e02580dc73 100644
--- a/src/applications/diffusion/conduit/DiffusionMergedCommitsQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionMergedCommitsQueryConduitAPIMethod.php
@@ -1,111 +1,111 @@
 <?php
 
 final class DiffusionMergedCommitsQueryConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'diffusion.mergedcommitsquery';
   }
 
   public function getMethodDescription() {
     return pht(
       'Merged commit information for a specific commit in a repository.');
   }
 
   protected function defineReturnType() {
     return 'array';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'commit' => 'required string',
       'limit' => 'optional int',
     );
   }
 
   private function getLimit(ConduitAPIRequest $request) {
     // TODO: Paginate this sensibly at some point.
     return $request->getValue('limit', 4096);
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $commit = $request->getValue('commit');
     $limit = $this->getLimit($request);
 
     list($parents) = $repository->execxLocalCommand(
-      'log -n 1 --format=%s %s',
+      'log -n 1 --format=%s %s --',
       '%P',
-      $commit);
+      gitsprintf('%s', $commit));
 
     $parents = preg_split('/\s+/', trim($parents));
     if (count($parents) < 2) {
       // This is not a merge commit, so it doesn't merge anything.
       return array();
     }
 
     // Get all of the commits which are not reachable from the first parent.
     // These are the commits this change merges.
 
     $first_parent = head($parents);
     list($logs) = $repository->execxLocalCommand(
       'log -n %d --format=%s %s %s --',
       // NOTE: "+ 1" accounts for the merge commit itself.
       $limit + 1,
       '%H',
-      $commit,
-      '^'.$first_parent);
+      gitsprintf('%s', $commit),
+      gitsprintf('%s', '^'.$first_parent));
 
     $hashes = explode("\n", trim($logs));
 
     // Remove the merge commit.
     $hashes = array_diff($hashes, array($commit));
 
     $history = DiffusionQuery::loadHistoryForCommitIdentifiers(
       $hashes,
       $drequest);
     return mpull($history, 'toDictionary');
    }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $commit = $request->getValue('commit');
     $limit = $this->getLimit($request);
 
     list($parents) = $repository->execxLocalCommand(
       'parents --template=%s --rev %s',
       '{node}\\n',
       hgsprintf('%s', $commit));
     $parents = explode("\n", trim($parents));
 
     if (count($parents) < 2) {
       // Not a merge commit.
       return array();
     }
 
     // NOTE: In Git, the first parent is the "mainline". In Mercurial, the
     // second parent is the "mainline" (the way 'git merge' and 'hg merge'
     // work is also reversed).
 
     $last_parent = last($parents);
     list($logs) = $repository->execxLocalCommand(
       'log --template=%s --follow --limit %d --rev %s:0 --prune %s --',
       '{node}\\n',
       $limit + 1,
       $commit,
       $last_parent);
 
     $hashes = explode("\n", trim($logs));
 
     // Remove the merge commit.
     $hashes = array_diff($hashes, array($commit));
 
     $history = DiffusionQuery::loadHistoryForCommitIdentifiers(
       $hashes,
       $drequest);
     return mpull($history, 'toDictionary');
   }
 
 }
diff --git a/src/applications/diffusion/conduit/DiffusionQueryPathsConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionQueryPathsConduitAPIMethod.php
index 09c07ec28f..98cc006419 100644
--- a/src/applications/diffusion/conduit/DiffusionQueryPathsConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionQueryPathsConduitAPIMethod.php
@@ -1,108 +1,108 @@
 <?php
 
 final class DiffusionQueryPathsConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'diffusion.querypaths';
   }
 
   public function getMethodDescription() {
     return pht('Filename search on a repository.');
   }
 
   protected function defineReturnType() {
     return 'list<string>';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'path' => 'required string',
       'commit' => 'required string',
       'pattern' => 'optional string',
       'limit' => 'optional int',
       'offset' => 'optional int',
     );
   }
 
   protected function getResult(ConduitAPIRequest $request) {
     $results = parent::getResult($request);
     $offset = $request->getValue('offset');
     return array_slice($results, $offset);
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $path = $drequest->getPath();
     $commit = $request->getValue('commit');
     $repository = $drequest->getRepository();
 
     // Recent versions of Git don't work if you pass the empty string, and
     // require "." to list everything.
     if (!strlen($path)) {
       $path = '.';
     }
 
     $future = $repository->getLocalCommandFuture(
       'ls-tree --name-only -r -z %s -- %s',
-      $commit,
+      gitsprintf('%s', $commit),
       $path);
 
     $lines = id(new LinesOfALargeExecFuture($future))->setDelimiter("\0");
     return $this->filterResults($lines, $request);
   }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
     $path = $request->getValue('path');
     $commit = $request->getValue('commit');
 
     $entire_manifest = id(new DiffusionLowLevelMercurialPathsQuery())
       ->setRepository($repository)
       ->withCommit($commit)
       ->withPath($path)
       ->execute();
 
     $match_against = trim($path, '/');
     $match_len = strlen($match_against);
 
     $lines = array();
     foreach ($entire_manifest as $path) {
       if (strlen($path) && !strncmp($path, $match_against, $match_len)) {
         $lines[] = $path;
       }
     }
 
     return $this->filterResults($lines, $request);
   }
 
   protected function filterResults($lines, ConduitAPIRequest $request) {
     $pattern = $request->getValue('pattern');
     $limit = (int)$request->getValue('limit');
     $offset = (int)$request->getValue('offset');
 
     if (strlen($pattern)) {
       // Add delimiters to the regex pattern.
       $pattern = '('.$pattern.')';
     }
 
     $results = array();
     $count = 0;
     foreach ($lines as $line) {
       if (strlen($pattern) && !preg_match($pattern, $line)) {
         continue;
       }
 
       $results[] = $line;
       $count++;
 
       if ($limit && ($count >= ($offset + $limit))) {
         break;
       }
     }
 
     return $results;
   }
 
 }
diff --git a/src/applications/diffusion/conduit/DiffusionSearchQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionSearchQueryConduitAPIMethod.php
index e2c56bb0f8..ba4c824061 100644
--- a/src/applications/diffusion/conduit/DiffusionSearchQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionSearchQueryConduitAPIMethod.php
@@ -1,129 +1,129 @@
 <?php
 
 final class DiffusionSearchQueryConduitAPIMethod
   extends DiffusionQueryConduitAPIMethod {
 
   public function getAPIMethodName() {
     return 'diffusion.searchquery';
   }
 
   public function getMethodDescription() {
     return pht('Search (grep) a repository at a specific path and commit.');
   }
 
   protected function defineReturnType() {
     return 'array';
   }
 
   protected function defineCustomParamTypes() {
     return array(
       'path' => 'required string',
       'commit' => 'optional string',
       'grep' => 'required string',
       'limit' => 'optional int',
       'offset' => 'optional int',
     );
   }
 
   protected function getResult(ConduitAPIRequest $request) {
     try {
       $results = parent::getResult($request);
     } catch (CommandException $ex) {
       $err = $ex->getError();
 
       if ($err === 1) {
         // `git grep` and `hg grep` exit with 1 if there are no matches;
         // assume we just didn't get any hits.
         return array();
       }
 
       throw $ex;
     }
 
     $offset = $request->getValue('offset');
     $results = array_slice($results, $offset);
 
     return $results;
   }
 
   protected function getGitResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $path = $drequest->getPath();
     $grep = $request->getValue('grep');
     $repository = $drequest->getRepository();
     $limit = $request->getValue('limit');
     $offset = $request->getValue('offset');
 
     // Starting with Git 2.16.0, Git assumes passing an empty argument is
     // an error and recommends you pass "." instead.
     if (!strlen($path)) {
       $path = '.';
     }
 
     $results = array();
     $future = $repository->getLocalCommandFuture(
       // NOTE: --perl-regexp is available only with libpcre compiled in.
       'grep --extended-regexp --null -n --no-color -f - %s -- %s',
-      $drequest->getStableCommit(),
+      gitsprintf('%s', $drequest->getStableCommit()),
       $path);
 
     // NOTE: We're writing the pattern on stdin to avoid issues with UTF8
     // being mangled by the shell. See T12807.
     $future->write($grep);
 
     $binary_pattern = '/Binary file [^:]*:(.+) matches/';
     $lines = new LinesOfALargeExecFuture($future);
 
     foreach ($lines as $line) {
       $result = null;
       if (preg_match('/[^:]*:(.+)\0(.+)\0(.*)/', $line, $result)) {
         $results[] = array_slice($result, 1);
       } else if (preg_match($binary_pattern, $line, $result)) {
         list(, $path) = $result;
         $results[] = array($path, null, pht('Binary file'));
       } else {
         $results[] = array(null, null, $line);
       }
       if (count($results) >= $offset + $limit) {
         break;
       }
     }
     unset($lines);
 
     return $results;
   }
 
   protected function getMercurialResult(ConduitAPIRequest $request) {
     $drequest = $this->getDiffusionRequest();
     $path = $drequest->getPath();
     $grep = $request->getValue('grep');
     $repository = $drequest->getRepository();
     $limit = $request->getValue('limit');
     $offset = $request->getValue('offset');
 
     $results = array();
     $future = $repository->getLocalCommandFuture(
       'grep --rev %s --print0 --line-number -- %s %s',
       hgsprintf('ancestors(%s)', $drequest->getStableCommit()),
       $grep,
       $path);
 
     $lines = id(new LinesOfALargeExecFuture($future))->setDelimiter("\0");
     $parts = array();
     foreach ($lines as $line) {
       $parts[] = $line;
       if (count($parts) == 4) {
         list($path, $char_offset, $line, $string) = $parts;
         $results[] = array($path, $line, $string);
         if (count($results) >= $offset + $limit) {
           break;
         }
         $parts = array();
       }
     }
     unset($lines);
 
     return $results;
   }
 
 }
diff --git a/src/applications/diffusion/query/blame/DiffusionGitBlameQuery.php b/src/applications/diffusion/query/blame/DiffusionGitBlameQuery.php
index 0eb15cd018..3525546111 100644
--- a/src/applications/diffusion/query/blame/DiffusionGitBlameQuery.php
+++ b/src/applications/diffusion/query/blame/DiffusionGitBlameQuery.php
@@ -1,38 +1,38 @@
 <?php
 
 final class DiffusionGitBlameQuery extends DiffusionBlameQuery {
 
   protected function newBlameFuture(DiffusionRequest $request, $path) {
     $repository = $request->getRepository();
 
     $commit = $request->getCommit();
 
     // NOTE: The "--root" flag suppresses the addition of the "^" boundary
     // commit marker. Without it, root commits render with a "^" before them,
     // and one fewer character of the commit hash.
 
     return $repository->getLocalCommandFuture(
       '--no-pager blame --root -s -l %s -- %s',
-      $commit,
+      gitsprintf('%s', $commit),
       $path);
   }
 
   protected function resolveBlameFuture(ExecFuture $future) {
     list($err, $stdout) = $future->resolve();
 
     if ($err) {
       return null;
     }
 
     $result = array();
 
     $lines = phutil_split_lines($stdout);
     foreach ($lines as $line) {
       list($commit) = explode(' ', $line, 2);
       $result[] = $commit;
     }
 
     return $result;
   }
 
 }
diff --git a/src/applications/diffusion/query/filecontent/DiffusionGitFileContentQuery.php b/src/applications/diffusion/query/filecontent/DiffusionGitFileContentQuery.php
index e0fb8bd9ee..8c8e362e60 100644
--- a/src/applications/diffusion/query/filecontent/DiffusionGitFileContentQuery.php
+++ b/src/applications/diffusion/query/filecontent/DiffusionGitFileContentQuery.php
@@ -1,18 +1,18 @@
 <?php
 
 final class DiffusionGitFileContentQuery extends DiffusionFileContentQuery {
 
   protected function newQueryFuture() {
     $drequest = $this->getRequest();
 
     $repository = $drequest->getRepository();
     $path = $drequest->getPath();
     $commit = $drequest->getCommit();
 
     return $repository->getLocalCommandFuture(
-      'cat-file blob %s:%s',
+      'cat-file blob -- %s:%s',
       $commit,
       $path);
   }
 
 }
diff --git a/src/applications/diffusion/query/lowlevel/DiffusionLowLevelParentsQuery.php b/src/applications/diffusion/query/lowlevel/DiffusionLowLevelParentsQuery.php
index a2673b0ce2..e0d9ef14b6 100644
--- a/src/applications/diffusion/query/lowlevel/DiffusionLowLevelParentsQuery.php
+++ b/src/applications/diffusion/query/lowlevel/DiffusionLowLevelParentsQuery.php
@@ -1,99 +1,99 @@
 <?php
 
 final class DiffusionLowLevelParentsQuery
   extends DiffusionLowLevelQuery {
 
   private $identifier;
 
   public function withIdentifier($identifier) {
     $this->identifier = $identifier;
     return $this;
   }
 
   protected function executeQuery() {
     if (!strlen($this->identifier)) {
       throw new PhutilInvalidStateException('withIdentifier');
     }
 
     $type = $this->getRepository()->getVersionControlSystem();
     switch ($type) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $result = $this->loadGitParents();
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $result = $this->loadMercurialParents();
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         $result = $this->loadSubversionParents();
         break;
       default:
         throw new Exception(pht('Unsupported repository type "%s"!', $type));
     }
 
     return $result;
   }
 
   private function loadGitParents() {
     $repository = $this->getRepository();
 
     list($stdout) = $repository->execxLocalCommand(
-      'log -n 1 --format=%s %s',
+      'log -n 1 --format=%s %s --',
       '%P',
-      $this->identifier);
+      gitsprintf('%s', $this->identifier));
 
     return preg_split('/\s+/', trim($stdout));
   }
 
   private function loadMercurialParents() {
     $repository = $this->getRepository();
 
     list($stdout) = $repository->execxLocalCommand(
       'log --debug --limit 1 --template={parents} --rev %s',
       $this->identifier);
 
     $stdout = DiffusionMercurialCommandEngine::filterMercurialDebugOutput(
       $stdout);
 
     $hashes = preg_split('/\s+/', trim($stdout));
     foreach ($hashes as $key => $value) {
       // Mercurial parents look like "23:ad9f769d6f786fad9f76d9a" -- we want
       // to strip out the local rev part.
       list($local, $global) = explode(':', $value);
       $hashes[$key] = $global;
 
       // With --debug we get 40-character hashes but also get the "000000..."
       // hash for missing parents; ignore it.
       if (preg_match('/^0+$/', $global)) {
         unset($hashes[$key]);
       }
     }
 
     return $hashes;
   }
 
   private function loadSubversionParents() {
     $repository = $this->getRepository();
     $identifier = $this->identifier;
 
     $refs = id(new DiffusionCachedResolveRefsQuery())
       ->setRepository($repository)
       ->withRefs(array($identifier))
       ->execute();
     if (!$refs) {
       throw new Exception(
         pht(
           'No commit "%s" in this repository.',
           $identifier));
     }
 
     $n = (int)$identifier;
     if ($n > 1) {
       $ids = array($n - 1);
     } else {
       $ids = array();
     }
 
     return $ids;
   }
 
 }
diff --git a/src/applications/diffusion/query/rawdiff/DiffusionGitRawDiffQuery.php b/src/applications/diffusion/query/rawdiff/DiffusionGitRawDiffQuery.php
index 41d91c00ca..f535724093 100644
--- a/src/applications/diffusion/query/rawdiff/DiffusionGitRawDiffQuery.php
+++ b/src/applications/diffusion/query/rawdiff/DiffusionGitRawDiffQuery.php
@@ -1,50 +1,50 @@
 <?php
 
 final class DiffusionGitRawDiffQuery extends DiffusionRawDiffQuery {
 
   protected function newQueryFuture() {
     $drequest = $this->getRequest();
     $repository = $drequest->getRepository();
 
     $commit = $this->getAnchorCommit();
 
     $options = array(
       '-M',
       '-C',
       '--no-ext-diff',
       '--no-color',
       '--src-prefix=a/',
       '--dst-prefix=b/',
       '-U'.(int)$this->getLinesOfContext(),
     );
 
     $against = $this->getAgainstCommit();
     if ($against === null) {
       // Check if this is the root commit by seeing if it has parents, since
       // `git diff X^ X` does not work if "X" is the initial commit.
       list($parents) = $repository->execxLocalCommand(
         'log -n 1 --format=%s %s --',
         '%P',
-        $commit);
+        gitsprintf('%s', $commit));
 
       if (strlen(trim($parents))) {
         $against = $commit.'^';
       } else {
         $against = ArcanistGitAPI::GIT_MAGIC_ROOT_COMMIT;
       }
     }
 
     $path = $drequest->getPath();
     if (!strlen($path)) {
       $path = '.';
     }
 
     return $repository->getLocalCommandFuture(
       'diff %Ls %s %s -- %s',
       $options,
-      $against,
-      $commit,
+      gitsprintf('%s', $against),
+      gitsprintf('%s', $commit),
       $path);
   }
 
 }