fix bash glob injection in device filename