From f221b4af188df182fdb616e48771f84f1291b972 Mon Sep 17 00:00:00 2001
From: Adam Honse <calcprogrammer1@gmail.com>
Date: Sat, 11 Apr 2026 18:30:07 -0500
Subject: [PATCH] Sanitize profile filenames

---
 ProfileManager.cpp                    | 10 ++++-----
 RGBController/RGBController_Dummy.cpp |  1 -
 StringUtils.cpp                       | 29 +++++++++++++++++++++++++++
 StringUtils.h                         |  1 +
 4 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/ProfileManager.cpp b/ProfileManager.cpp
index d8c9c94a2..51876ca74 100644
--- a/ProfileManager.cpp
+++ b/ProfileManager.cpp
@@ -279,7 +279,7 @@ void ProfileManager::DeleteProfile(std::string profile_name)
     }
     else
     {
-        filesystem::path filename = profile_directory / profile_name;
+        filesystem::path filename = profile_directory / StringUtils::make_filename(profile_name);
         filename.concat(".json");
 
         filesystem::remove(filename);
@@ -524,7 +524,7 @@ nlohmann::json ProfileManager::ReadProfileJSON(std::string profile_name)
         /*-------------------------------------------------*\
         | File extension for v6+ profiles is .json          |
         \*-------------------------------------------------*/
-        profile_name += ".json";
+        profile_name = StringUtils::make_filename(profile_name) + ".json";
 
         /*-------------------------------------------------*\
         | Read the profile JSON from the file               |
@@ -774,7 +774,7 @@ bool ProfileManager::SaveProfileFromJSON(nlohmann::json profile_json)
 {
     if(profile_json.contains("profile_name"))
     {
-        std::string profile_filename = profile_json["profile_name"];
+        std::string profile_filename = StringUtils::make_filename(profile_json["profile_name"]);
 
         profile_filename.append(".json");
 
@@ -1024,9 +1024,9 @@ void ProfileManager::UpdateProfileList()
 
                 nlohmann::json profile_json = ReadProfileFileJSON(file_path);
 
-                if(!profile_json.empty())
+                if(!profile_json.empty() && profile_json.contains("profile_name"))
                 {
-                    profile_list.push_back(filename.erase(filename.length() - 5));
+                    profile_list.push_back(profile_json["profile_name"]);
                 }
             }
         }
diff --git a/RGBController/RGBController_Dummy.cpp b/RGBController/RGBController_Dummy.cpp
index 2461a4c0e..47aa0d574 100644
--- a/RGBController/RGBController_Dummy.cpp
+++ b/RGBController/RGBController_Dummy.cpp
@@ -44,7 +44,6 @@ RGBController_Dummy::RGBController_Dummy()
 
 RGBController_Dummy::~RGBController_Dummy()
 {
-    Shutdown();
 }
 
 void RGBController_Dummy::SetupZones()
diff --git a/StringUtils.cpp b/StringUtils.cpp
index 880a60bf4..41854ef1d 100644
--- a/StringUtils.cpp
+++ b/StringUtils.cpp
@@ -21,6 +21,7 @@
 
 #include <codecvt>
 #include <locale>
+#include <regex>
 #include <string>
 #include "StringUtils.h"
 
@@ -94,3 +95,31 @@ const std::string StringUtils::remove_null_terminating_chars(std::string input)
 
     return(input);
 }
+
+std::string StringUtils::make_filename(std::string input)
+{
+    /*-----------------------------------------------------*\
+    | Replace : characters with - characters                |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex(":"), "-");
+
+    /*-----------------------------------------------------*\
+    | Remove all other characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove leading . characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("^\\.+"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove control characters                             |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), "");
+
+    /*-----------------------------------------------------*\
+    | Return complete string                                |
+    \*-----------------------------------------------------*/
+    return(input);
+}
diff --git a/StringUtils.h b/StringUtils.h
index 8a200f937..b2b0d2cfc 100644
--- a/StringUtils.h
+++ b/StringUtils.h
@@ -18,4 +18,5 @@ public:
     static std::string wstring_to_string(const std::wstring wstring);
     static std::string u16string_to_string(const std::u16string wstring);
     static const std::string remove_null_terminating_chars(std::string input);
+    static std::string make_filename(std::string input);
 };