Preset names are not escaped / treated as literal

[Tkael]

The DetectBindsFile method can reject preset names containing Regex special characters and can return a "No bindings file found" error instead. For example, with my bindings file "T16000M HOTAS (T'kael).4.0.binds" the parenthesis are treated as regex characters rather than as part of the literal prefix name which causes a mismatch. The prefix name needs to be treated literally.

[alterNERDtive]

We’ve had SQL injection, but what about regex injection⁈ :)

[Tkael]

I'm looking at changing lines 301-303 of bindED.cs to

            FileInfo[] bindFiles = dirInfo.GetFiles()
                .Where(i => Regex.Match(i.Name, $@"^{Regex.Escape(preset ?? string.Empty)}\.[34]\.0\.binds$").Success)
                .OrderByDescending(p => p.Name).ToArray();

[Tkael]

The change seems to be working.

10:53:57.115 INFO | bindED: Elite binds 'T16000M HOTAS (T'kael)' for layout 'en-us' loaded successfully.

[alterNERDtive]

I should have just let you do a pull request instead of doing the exact same thing in parallel =p

Anyway, the nullable preset parameter didn’t really make sense, so instead of doing a Regex.Escape(preset ?? string.Empty) I changed that instead.

[alterNERDtive]

(fixed next release which I’m probably going to do soon™ in light of this bug)

[Tkael]

Fixed locally in the meantime. Thanks. :-)