fix(wiki): controls --lang value by stripping control characters & newlines, cap length to prevent prompt injection

This commit is contained in:
sanguine59 2026-05-17 16:44:08 +07:00
parent b849743dbc
commit f951627595

View file

@ -184,8 +184,12 @@ export class WikiGenerator {
* Append an output-language instruction to a system prompt when --lang is set.
*/
private buildSystemPrompt(base: string): string {
if (!this.options.lang) return base;
const lang = this.options.lang.trim();
// Strip control characters and newlines, then cap length to prevent prompt injection.
const lang = (this.options.lang ?? '')
.replace(/[\x00-\x1F\x7F]/g, '')
.trim()
.slice(0, 50);
if (!lang) return base;
return `${base}\n\nIMPORTANT: Write ALL documentation content in ${lang}. This includes prose, code comments in examples, and diagram labels. Note: page titles (H1 headings) are generated separately and will remain in English.`;
}