Sanitize checkpoint tags (#4813)

1 files changed, 6 insertions, 0 deletions

diff --git a/packages/core/src/core/logger.ts b/packages/core/src/core/logger.ts
index e857bd46..450a0d2f 100644
--- a/packages/core/src/core/logger.ts
+++ b/packages/core/src/core/logger.ts
@@ -238,6 +238,12 @@ export class Logger {
     if (!this.geminiDir) {
       throw new Error('Checkpoint file path not set.');
     }
+    // Sanitize tag to prevent directory traversal attacks
+    tag = tag.replace(/[^a-zA-Z0-9-_]/g, '');
+    if (!tag) {
+      console.error('Sanitized tag is empty setting to "default".');
+      tag = 'default';
+    }
     return path.join(this.geminiDir, `checkpoint-${tag}.json`);
   }