Address security issues in release_candidate_1.0rc3

- CVE-2026-59682: OpenRGB: arbitrary file overwrite and deletion local and remote
- CVE-2026-59683: OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
- CVE-2026-18794: OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

StringUtils.cpp

@@ -22,6 +22,7 @@
 #include <cctype>
 #include <codecvt>
 #include <locale>
+#include <regex>
 #include <string>
 #include "StringUtils.h"
 
@@ -113,6 +114,34 @@ std::string StringUtils::u32int_to_hexString(unsigned int value)
     return std::string(hex_str);
 }
 
+std::string StringUtils::make_filename(std::string input)
+{
+    /*-----------------------------------------------------*\
+    | Replace : characters with - characters                |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex(":"), "-");
+
+    /*-----------------------------------------------------*\
+    | Remove all other characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove leading . characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("^\\.+"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove control characters                             |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), "");
+
+    /*-----------------------------------------------------*\
+    | Return complete string                                |
+    \*-----------------------------------------------------*/
+    return(input);
+}
+
 std::string StringUtils::normalize_hex_id(const std::string& id)
 {
     std::string out;