Function sanitize_extra_flags 

pub fn sanitize_extra_flags(flags: &str) -> Result<Vec<String>, String>

_sanitize_extra_flags(flags): shell-style split, then refuse any token carrying a shell metacharacter.