Code review and fixes.

internal/config/validation.go

@@ -33,6 +33,14 @@ import (
 // Validate checks the complete configuration without touching the filesystem.
 func Validate(settings Settings) error { return validate(settings) }
 
+// ValidWineProgramName reports whether an exclusion is an executable basename
+// accepted by settings, preferences, and the helper launch boundary.
+func ValidWineProgramName(name string) bool {
+	return name != "" && len(name) <= 255 && strings.TrimSpace(name) == name &&
+		!strings.ContainsAny(name, `/\`) &&
+		!strings.ContainsFunc(name, func(character rune) bool { return character < ' ' })
+}
+
 func validate(settings Settings) error {
 	if len(settings.Wine.ExcludedPrograms) > 256 {
 		return errors.New("too many Wine hook exclusions")
@@ -40,7 +48,7 @@ func validate(settings Settings) error {
 	exclusionUnits := 0
 	for _, name := range settings.Wine.ExcludedPrograms {
 		exclusionUnits += len(utf16.Encode([]rune(name))) + 1
-		if name == "" || len(name) > 255 || strings.TrimSpace(name) != name || strings.ContainsAny(name, "\x00\r\n/\\") {
+		if !ValidWineProgramName(name) {
 			return errors.New("Wine hook exclusions must be executable basenames")
 		}
 	}

internal/config/wine_test.go

@@ -4,6 +4,7 @@
 package config
 
 import (
+	"fmt"
 	"path/filepath"
 	"reflect"
 	"testing"
@@ -39,3 +40,15 @@ func TestWineSettingsRoundTripAndValidation(t *testing.T) {
 		}
 	}
 }
+
+func TestWineSettingsRejectEmbeddedControlCharacters(t *testing.T) {
+	for character := rune(0); character < ' '; character++ {
+		t.Run(fmt.Sprintf("U+%04X", character), func(t *testing.T) {
+			settings := DefaultSettings()
+			settings.Wine.ExcludedPrograms = []string{"Game" + string(character) + ".exe"}
+			if err := Validate(settings); err == nil {
+				t.Fatalf("accepted control character in exclusion %q", settings.Wine.ExcludedPrograms[0])
+			}
+		})
+	}
+}