From c6a36f4e75c57667e55d14cadec7a8a305c322fa Mon Sep 17 00:00:00 2001
From: sanguine59 <the6seas0n@gmail.com>
Date: Sun, 17 May 2026 16:47:06 +0700
Subject: [PATCH] fix(wiki): validates already sanitized --lang value to only
 accept alphabets

---
 gitnexus/src/core/wiki/generator.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gitnexus/src/core/wiki/generator.ts b/gitnexus/src/core/wiki/generator.ts
index 7e5ddd2c6..b9c5c498d 100644
--- a/gitnexus/src/core/wiki/generator.ts
+++ b/gitnexus/src/core/wiki/generator.ts
@@ -184,12 +184,12 @@ export class WikiGenerator {
    * Append an output-language instruction to a system prompt when --lang is set.
    */
   private buildSystemPrompt(base: string): string {
-    // Strip control characters and newlines, then cap length to prevent prompt injection.
+    // Strip control characters, trim, cap length, then validate against a character allowlist.
     const lang = (this.options.lang ?? '')
       .replace(/[\x00-\x1F\x7F]/g, '')
       .trim()
       .slice(0, 50);
-    if (!lang) return base;
+    if (!lang || !/^[a-zA-Z -]+$/.test(lang)) return base;
     return `${base}\n\nIMPORTANT: Write ALL documentation content in ${lang}. This includes prose, code comments in examples, and diagram labels. Note: page titles (H1 headings) are generated separately and will remain in English.`;
   }