Sanitize filenames from clients in NetworkServer

NetworkServer.cpp

@@ -8,6 +8,7 @@
 
 #include "NetworkServer.h"
 #include "LogManager.h"
+#include "StringUtils.h"
 #include <cstring>
 
 #ifndef WIN32
@@ -780,7 +781,7 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info)
 
                 if(profile_manager)
                 {
-                    profile_manager->SaveProfile(data);
+                    profile_manager->SaveProfile(StringUtils::make_filename(data));
                 }
 
                 break;
@@ -793,7 +794,7 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info)
 
                 if(profile_manager)
                 {
-                    profile_manager->LoadProfile(data);
+                    profile_manager->LoadProfile(StringUtils::make_filename(data));
                 }
 
                 for(RGBController* controller : controllers)
@@ -811,7 +812,7 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info)
 
                 if(profile_manager)
                 {
-                    profile_manager->DeleteProfile(data);
+                    profile_manager->DeleteProfile(StringUtils::make_filename(data));
                 }
 
                 break;

StringUtils.cpp

@@ -38,3 +38,31 @@ const char* StringUtils::wchar_to_char(const wchar_t* pwchar)
 
     return filePathC;
 }
+
+std::string StringUtils::make_filename(std::string input)
+{
+    /*-----------------------------------------------------*\
+    | Replace : characters with - characters                |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex(":"), "-");
+
+    /*-----------------------------------------------------*\
+    | Remove all other characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove leading . characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("^\\.+"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove control characters                             |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), "");
+
+    /*-----------------------------------------------------*\
+    | Return complete string                                |
+    \*-----------------------------------------------------*/
+    return(input);
+}

StringUtils.h

@@ -5,6 +5,7 @@ class StringUtils
 {
 public:
     static const char* wchar_to_char(const wchar_t* pwchar);
+    static std::string make_filename(std::string input);
 };
 
 #endif // STRING_UTILS_H