Date format string in settings allows garbage

[Nos78]

There is no validation for the date formatting string, so that garbage could be entered which may cause unexpected behaviour when calling Date().format(garbage_string) during file header inserting or during a "modified at" update.

The date formatting should comply with ISO 8601 which specifies how to construct a valid format string and specifies what characters are allowed.,

[Nos78]

I constructed a regex:

(?=\D*(?:[y]{1,4}|[Md]{2,3})(?:[/\-., ])?((?:[y]{1,4}|[Md]{2,3})(?:[/\-., ])?)?(?:[y]{1,4}|[Md]{2,3})(?:[., ]*)?)(?=\D*((?:[hms]{2}[:. ]?(?:[hms]{2})?[:. ]?(?:[hms]{2})?[:. ]?S?)(?:[., ]*)?))^[yMdhmsS:.,/\- ]*$

There are two look-aheads in this regex. In the first one, it looks for strings of the form yyyy-MM-dd, and permits the letters in any order, and with several allowable optional seperators ('', '-', '.', ',' and space) so that ddMMyy MM/dd/yyyy, etc, are permitted,
(?=\D*(?:[y]{1,4}|[Md]{2,3})(?:[/\-., ])?((?:[y]{1,4}|[Md]{2,3})(?:[/\-., ])?)?(?:[y]{1,4}|[Md]{2,3})(?:[., ]*)?)

The second look-ahead checks for any time portion, with hmsS as allowable characters, with several optional separators, so that hh:mm, hh.mm.ss, and hhmmss.S are all permitted."fileheader.dateFormat":

(?=\D*((?:[hms]{2}[:. ]?(?:[hms]{2})?[:. ]?(?:[hms]{2})?[:. ]?S?)(?:[., ]*)?))

Both of the above look-ahead groups are prefixed with ?=\D*, which defines a look-ahead and begins the search by looking for 0 or more non-digit characters (e.g. the start of the string! It didn't work by explicitly using the ^ character for the start of the string).
`
By using look-aheads, we can allow matches to either group to be in"fileheader.dateFormat":

 any order without having to repeat the portions multiple times to allow the different combinations.

The final section of the regex actually returns the text, as this is not a look-ahead group. We could simply have used ^.*$ here, but this way we only return the combined set of allowable characters permitted in either look-ahead group, which adds an extra validation.
^[yMdhmsS:.,/\- ]*$

I used the tool at (regexr.com)[https://regexr.com] to construct and test the regex, with the following text to check it works:

yyyy-MM-dd mm:hh

yyyy-MM-dd hh:mm:ss

yy/MM/dd hh.mm.ss.S

yyyy/MM/dd

hh:mm:ss yy/MM/dd
yy/MM/dd hh:mm:ss

hh.mm.ss.S yy/MM/dd

hh:mm:ss.S

MM/dd/yy

dd/MM/yy
hh.mm.ss.S
hh mm ss yyyy MM dd
hh/mm/ss
MM/yy/dd hh

hh:mm:ss yy/MM/dd

dd/yy/

yy/dd/MM

yy/MM/dd/MM

And finally, by putting the completed regex into (freeformatter.com)[https://www.freeformatter.com/json-escape.html#before-output] we can escape all the characters that need to be escaped so that we can paste the regex into the "pattern" field of package.json.

Here is the completed json block with validation:

"fileheader.dateFormat": {
    "type": "string",
    "default": "yyyy-MM-dd hh:mm:ss",
    "markdownDescription": "The date & time format to use for indicating when a file was created or last modified at.",
    "pattern": "(?=\\D*(?:[y]{1,4}|[Md]{2,3})(?:[\/\\-., ])?((?:[y]{1,4}|[Md]{2,3})(?:[\/\\-., ])?)?(?:[y]{1,4}|[Md]{2,3})(?:[., ]*)?)(?=\\D*((?:[hms]{2}[:. ]?(?:[hms]{2})?[:. ]?(?:[hms]{2})?[:. ]?S?)(?:[., ]*)?))^[yMdhmsS:.,\/\\- ]*$",
    "patternErrorMessage": "Please input a valid date formatting string (Refer to ISO-8601 for more information).",
    "order": 4
}

[Nos78]

This fix was released as part of release-candidate-v0.2.2 - keeping the issue open to allow any user feedback since this was a complex regex and may cause issues. Return in 7 days and if no issue, can close this.