From 785c832d6a797103cf872b5ea6562e8dc59f24be Mon Sep 17 00:00:00 2001
From: lukeflo
Date: Sun, 6 Jul 2025 12:36:53 +0200
Subject: add forbidden chars to README

---
 README.md  | 6 ++++++
 src/app.rs | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/README.md b/README.md
index 947c1d6..c00d288 100644
--- a/README.md
+++ b/README.md
@@ -440,6 +440,12 @@ directory is set to the value of the `note_path` variable. The extension can be
 choosen from one of the file format extension set in the `note_extensions`
 array.
 
+**Be aware**: The operation of creating new notes is not permitted if the
+citekey contains some special chars which could cause problems with Unixish
+shell commands and file operations. Currently the following chars are not
+allowed as part of the citekey: `/` | `|` | `#` | `*` | `\\` | `"` | `'` | `;` |
+`!`
+
 The bibfile itself will *not be edited*. Therefore, you can't break anything in
 your bibfile with this operation!
 
diff --git a/src/app.rs b/src/app.rs
index 708ec37..8b76f17 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -435,11 +435,16 @@ impl App {
                         .unwrap()]
                     .citekey
                     .clone();
+                    // disallow chars which can cause other shell executions
                     if citekey.contains("/")
                         | citekey.contains("|")
                         | citekey.contains("#")
                         | citekey.contains("\\")
                         | citekey.contains("*")
+                        | citekey.contains("\"")
+                        | citekey.contains(";")
+                        | citekey.contains("!")
+                        | citekey.contains("\'")
                     {
                         self.bibiman.open_popup(
                             PopupKind::MessageError,
-- 
cgit v1.2.3