Some more doc examples

Also disallow fragments that start with -

docs/kittens/hyperlinked_grep.rst

@@ -31,12 +31,12 @@ following contents:
     # by the hyperlink-grep kitten and nothing else so far.
     protocol file
     fragment_matches [0-9]+
-    action launch --type=overlay --cwd=current vim +${FRAGMENT} ${FILE_PATH}
+    action launch --type=overlay --cwd=current vim +${FRAGMENT} -- ${FILE_PATH}
 
     # Open text files without fragments in the editor
     protocol file
     mime text/*
-    action launch --type=overlay --cwd=current ${EDITOR} ${FILE_PATH}
+    action launch --type=overlay --cwd=current -- ${EDITOR} -- ${FILE_PATH}
 
 Now, run a search with::
 

kitty/open_actions.py

@@ -164,9 +164,16 @@ def actions_for_url_from_list(url: str, actions: Iterable[OpenAction]) -> Iterat
         return
     path = unquote(purl.path)
     up = purl.path
+    frag = ''
     if purl.query:
         up += f'?{purl.query}'
     if purl.fragment:
+        frag = unquote(purl.fragment)
+        if frag.startswith('-'):
+            # Dont allow fragments that startwith - as that can lead to arg
+            # injection
+            log_error('Ignoring fragment that starts with - in URL:', url)
+            frag = ''
         up += f'#{purl.fragment}'
 
     env = {
@@ -174,7 +181,7 @@ def actions_for_url_from_list(url: str, actions: Iterable[OpenAction]) -> Iterat
         'FILE_PATH': path,
         'URL_PATH': up,
         'FILE': posixpath.basename(path),
-        'FRAGMENT': unquote(purl.fragment)
+        'FRAGMENT': frag,
     }
 
     def expand(x: Any) -> Any:

kitty/window.py

@@ -1073,6 +1073,11 @@ class Window:
                         self.handle_remote_file(purl.netloc, unquote(purl.path))
                         return
                     url = urlunparse(purl._replace(netloc=''))
+            if purl.fragment and purl.fragment.startswith('-'):
+                # Dont allow fragments that startwith - as that can lead to arg
+                # injection
+                log_error('Ignoring fragment that starts with - in URL:', url)
+                url = urlunparse(purl._replace(fragment=''))
             if opts.allow_hyperlinks & 0b10:
                 from kittens.tui.operations import styled
                 boss.choose(