Current Behavior

In the project feature, any characters can be used for the flow file name. Node-RED users can save the flow file to the parent directory with the path, ../flows.json.

Expected Behavior

The input validator should be stricter. It only supports the alphabetical characters, numbers, and limited characters as same as project name.

Steps To Reproduce

No response

Example flow

Environment

• Node-RED version: v4.1.2
• Node.js version: v22.17.1
• npm version: v10.9.2
• Platform/OS: macOS 26.0.1 (25A362) on Apple M1 Macbook Air
• Browser: Google Chrome Version 142.0.7444.176 (Official Build) (arm64)