add some string validation

extensions/llamacpp-extension/src/index.ts

@@ -229,7 +229,19 @@ export default class llamacpp_extension extends AIEngine {
   }
 
   override async import(modelId: string, opts: ImportOptions): Promise<void> {
-    // TODO: sanitize modelId
+    const isValidModelId = (id: string) => {
+      // only allow alphanumeric, underscore, hyphen, and dot characters in modelId
+      if (!/^[a-zA-Z0-9/_\-\.]+$/.test(id)) return false
+
+      // check for empty parts or path traversal
+      const parts = id.split('/')
+      return parts.every(s => s !== '' && s !== '.' && s !== '..')
+    }
+
+    if (!isValidModelId(modelId)) {
+      throw new Error(`Invalid modelId: ${modelId}. Only alphanumeric and / _ - . characters are allowed.`)
+    }
+
     let configPath = await joinPath([this.modelsBasePath, this.provider, modelId, 'model.yml'])
     if (await fs.existsSync(configPath)) {
       throw new Error(`Model ${modelId} already exists`)