From 3058442adeab8ba5978c1d87842d775a0cd227c3 Mon Sep 17 00:00:00 2001
From: Patrick Dawkins <patrick@platform.sh>
Date: Wed, 26 Oct 2022 10:47:42 +0100
Subject: [PATCH] Escape the program path in the completion command

---
 src/HookFactory.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/HookFactory.php b/src/HookFactory.php
index d86f9b2..dc4e70e 100644
--- a/src/HookFactory.php
+++ b/src/HookFactory.php
@@ -147,9 +147,9 @@ public function generateHook($type, $programPath, $programName = null, $multiple
         $programName = $programName ?: $programPath;
 
         if ($multiple) {
-            $completionCommand = '$1 _completion';
+            $completionCommand = '"$1" _completion';
         } else {
-            $completionCommand = $programPath . ' _completion';
+            $completionCommand = escapeshellarg($programPath) . ' _completion';
         }
 
         // Pass shell type during completion so output can be encoded if the shell requires it