From 4a5f573d5316e4d6eb6e7dd8a5480c14832c164c Mon Sep 17 00:00:00 2001
From: Alexopus <alexopus.soft@gmail.com>
Date: Sat, 19 Jul 2025 22:33:44 +0200
Subject: [PATCH] validate filenames

---
 js/extension.js | 33 +++++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/js/extension.js b/js/extension.js
index 9e6b8db..080b7a4 100644
--- a/js/extension.js
+++ b/js/extension.js
@@ -427,10 +427,19 @@ class NotesSidebar {
     }
 
     async renameActiveNote() {
-        const newName = prompt('Enter new note name:', this.activeNote);
+        let newName = prompt('Enter new note name:', this.activeNote);
+        if (!newName) return;
+
+        // Trim spaces
+        newName = newName.trim();
         if (!newName || newName === this.activeNote) return;
 
         try {
+            if (!isValidFilename(newName)) {
+                alert('Invalid filename! Please avoid special characters like / \\ : * ? " < > |');
+                return;
+            }
+
             // Check if new name already exists
             if (this.notes.includes(newName)) {
                 alert('A note with this name already exists!');
@@ -471,11 +480,20 @@ class NotesSidebar {
     async createNewNote() {
         let noteName;
 
-        // Keep asking for a name until user cancels or enters a unique name
+        // Keep asking for a name until user cancels or enters a valid unique name
         while (true) {
             noteName = prompt('Enter note name:');
             if (!noteName) return; // User cancelled
 
+            // Trim spaces
+            noteName = noteName.trim();
+
+            // Validate filename safety
+            if (!isValidFilename(noteName)) {
+                alert('Invalid filename! Please avoid special characters like / \\ : * ? " < > |');
+                continue; // Ask again
+            }
+
             // Check if note name already exists
             if (this.notes.includes(noteName)) {
                 alert('A note with this name already exists!');
@@ -528,6 +546,17 @@ class NotesSidebar {
     }
 }
 
+// Helper function to validate filename safety
+function isValidFilename(filename) {
+    if (!filename || filename.trim() === '') return false;
+
+    // Check for unsafe characters: / \\ : * ? " < > |
+    const unsafeChars = /[/\\:*?"<>|]/;
+    if (unsafeChars.test(filename)) return false;
+
+    return true;
+}
+
 const notesSidebar = new NotesSidebar();
 
 app.registerExtension({