From 70bb47919d6cb5b9dd093296ee305ec5d3791f6e Mon Sep 17 00:00:00 2001
From: Kid <kidonng@gmail.com>
Date: Thu, 14 Jan 2021 11:47:06 +0800
Subject: [PATCH 1/2] Prevent user input polluting arguments

---
 functions/__fzf_search_current_dir.fish     | 4 ++--
 functions/__fzf_search_history.fish         | 2 +-
 functions/__fzf_search_shell_variables.fish | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/functions/__fzf_search_current_dir.fish b/functions/__fzf_search_current_dir.fish
index 73d24e3b..ae323e82 100644
--- a/functions/__fzf_search_current_dir.fish
+++ b/functions/__fzf_search_current_dir.fish
@@ -9,7 +9,7 @@ function __fzf_search_current_dir --description "Search the current directory. R
 
     # If the current token is a directory and has a trailing slash,
     # then use it as fd's base directory.
-    if string match --quiet "*/" $token && test -d $token
+    if string match --quiet -- "*/" $token && test -d $token
         set --append fd_arguments --base-directory=$token
         # use the directory name as fzf's prompt to indicate the search is limited to that directory
         set --append fzf_arguments --prompt=$token --preview="__fzf_preview_file $token{}"
@@ -34,7 +34,7 @@ function __fzf_search_current_dir --description "Search the current directory. R
             end
         end
 
-        commandline --current-token --replace (string escape $file_paths_selected | string join ' ')
+        commandline --current-token --replace -- (string escape -- $file_paths_selected | string join ' ')
     end
 
     commandline --function repaint
diff --git a/functions/__fzf_search_history.fish b/functions/__fzf_search_history.fish
index 1b95db20..3afdb6ac 100644
--- a/functions/__fzf_search_history.fish
+++ b/functions/__fzf_search_history.fish
@@ -10,7 +10,7 @@ function __fzf_search_history --description "Search command history. Replace the
 
     if test $status -eq 0
         set command_selected (string split --max 1 " | " $command_with_ts)[2]
-        commandline --replace $command_selected
+        commandline --replace -- $command_selected
     end
 
     commandline --function repaint
diff --git a/functions/__fzf_search_shell_variables.fish b/functions/__fzf_search_shell_variables.fish
index 6da2240f..f4929e39 100644
--- a/functions/__fzf_search_shell_variables.fish
+++ b/functions/__fzf_search_shell_variables.fish
@@ -27,7 +27,7 @@ function __fzf_search_shell_variables --argument-names set_show_output set_names
     set current_token (commandline --current-token)
     # Use the current token to pre-populate fzf's query. If the current token begins
     # with a $, remove it from the query so that it will better match the variable names
-    set cleaned_curr_token (string replace '$' '' $current_token)
+    set cleaned_curr_token (string replace -- '$' '' $current_token)
 
     set variable_name (
         printf '%s\n' $all_variable_names |
@@ -38,7 +38,7 @@ function __fzf_search_shell_variables --argument-names set_show_output set_names
     if test $status -eq 0
         # If the current token begins with a $, do not overwrite the $ when
         # replacing the current token with the selected variable.
-        if string match --quiet '$*' $current_token
+        if string match --quiet -- '$*' $current_token
             commandline --current-token --replace \$$variable_name
         else
             commandline --current-token --replace $variable_name

From 028dfe820043d7599bf849d89ddadb4b6bce8137 Mon Sep 17 00:00:00 2001
From: Kid <kidonng@gmail.com>
Date: Sat, 16 Jan 2021 09:46:02 +0800
Subject: [PATCH 2/2] Git status

---
 functions/__fzf_search_git_status.fish | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/functions/__fzf_search_git_status.fish b/functions/__fzf_search_git_status.fish
index 396be8d6..91b549ea 100644
--- a/functions/__fzf_search_git_status.fish
+++ b/functions/__fzf_search_git_status.fish
@@ -22,7 +22,7 @@ function __fzf_search_git_status --description "Search the output of git status.
                 end
             end
 
-            commandline --current-token --replace (string escape $cleaned_paths | string join ' ')
+            commandline --current-token --replace -- (string escape -- $cleaned_paths | string join ' ')
         end
     end