kiss: more relaxed sanitization as per POSIX globbing spec.

FossilOrigin-Name: 33ed6d93f3e9f757af1c88c985fd88d39ee37cec63bc6a4e1b0960f2479effd7

1 files changed, 4 insertions, 1 deletions

diff --git a/kiss b/kiss
index a05a46a..88a758f 100755
--- a/kiss
+++ b/kiss
@@ -858,9 +858,12 @@ args() {
     # Unless this is a search, sanitize the user's input. The call to
     # 'pkg_find()' supports basic globbing, ensure input doesn't expand
     # to anything except for when this behavior is needed.
+    #
+    # This handles the globbing characters '*', '!', '[' and ']' as per:
+    # https://pubs.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
     [ "$action" != search ] && [ "$action" != s ] &&
         case $* in
-            *[!a-zA-Z0-9_-]*)
+            *'*'*|*'!'*|*'['*|*']'*)
                 log kiss "$action $*"
                 die "Arguments contain invalid characters"
             ;;