You could use a character class to accept : and - in the validatecommand sub.

'-validatecommand'  => sub {$_[1] =~/[\w:-]+/ ;} ,
[download]

WRT your invalidcommand sub, the regexp does nothing at the moment. Should the first line be something like this if you want to accept control characters?

'-invalidcommand' => sub {
                          return if $_[1] =~/^[[:cntrl:]] ;
                          $top -> bell;
                         }
[download]

Or do you want the bell if it starts with a control character?

'-invalidcommand' => sub {
                          $top -> bell if $_[1] =~/^[[:cntrl:]] ;
                         }
[download]

I don't code with Tk, but hopefully this is useful.