Description
Saved theme profiles loaded from themeProfiles.json are returned without validating profile names or sanitizing profile contents. getThemeProfiles() returns settingsStore.loadProfiles() directly, while load/delete/duplicate/export paths validate names later, creating inconsistent behavior.
If the file contains legacy, corrupt, or manually edited invalid profile keys, Settings can display profiles that later cannot be loaded, deleted, duplicated, or exported consistently.
Steps to Reproduce
- Add an invalid key such as
bad/profile:name to themeProfiles.json.
- Restart Paraline and open Settings.
- Check the theme profile dropdown and try loading, deleting, duplicating, or exporting that profile.
Expected Behaviour
Only profiles with valid names should be exposed to the UI. Invalid entries should be filtered out or migrated during load so all profile actions behave consistently.
Actual Behaviour
loadProfiles() returns the raw parsed object. Invalid profile names can appear in the Settings dropdown even though main-process profile actions reject them later.
Evidence
settingsStore.loadProfiles() only checks that parsed JSON is a non-array object, then returns it directly.
getThemeProfiles() returns settingsStore.loadProfiles() directly.
- Settings renders every returned profile key into the dropdown.
- Later profile actions validate names with
isValidProfileName() before acting.
Environment
- OS: Windows
- Browser / Node version: Node v22.17.0, Electron ^37.0.0
- Repo version / commit: v2.2.0 / dbaae83
Description
Saved theme profiles loaded from
themeProfiles.jsonare returned without validating profile names or sanitizing profile contents.getThemeProfiles()returnssettingsStore.loadProfiles()directly, while load/delete/duplicate/export paths validate names later, creating inconsistent behavior.If the file contains legacy, corrupt, or manually edited invalid profile keys, Settings can display profiles that later cannot be loaded, deleted, duplicated, or exported consistently.
Steps to Reproduce
bad/profile:nametothemeProfiles.json.Expected Behaviour
Only profiles with valid names should be exposed to the UI. Invalid entries should be filtered out or migrated during load so all profile actions behave consistently.
Actual Behaviour
loadProfiles()returns the raw parsed object. Invalid profile names can appear in the Settings dropdown even though main-process profile actions reject them later.Evidence
settingsStore.loadProfiles()only checks that parsed JSON is a non-array object, then returns it directly.getThemeProfiles()returnssettingsStore.loadProfiles()directly.isValidProfileName()before acting.Environment