From f95162759573a85d78cbb1e9be526a3cda4a3713 Mon Sep 17 00:00:00 2001
From: sanguine59 <the6seas0n@gmail.com>
Date: Sun, 17 May 2026 16:44:08 +0700
Subject: [PATCH] fix(wiki): controls --lang value by stripping control
 characters & newlines, cap length to prevent prompt injection

---
 gitnexus/src/core/wiki/generator.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/gitnexus/src/core/wiki/generator.ts b/gitnexus/src/core/wiki/generator.ts
index cc8706689..7e5ddd2c6 100644
--- a/gitnexus/src/core/wiki/generator.ts
+++ b/gitnexus/src/core/wiki/generator.ts
@@ -184,8 +184,12 @@ export class WikiGenerator {
    * Append an output-language instruction to a system prompt when --lang is set.
    */
   private buildSystemPrompt(base: string): string {
-    if (!this.options.lang) return base;
-    const lang = this.options.lang.trim();
+    // Strip control characters and newlines, then cap length to prevent prompt injection.
+    const lang = (this.options.lang ?? '')
+      .replace(/[\x00-\x1F\x7F]/g, '')
+      .trim()
+      .slice(0, 50);
+    if (!lang) return base;
     return `${base}\n\nIMPORTANT: Write ALL documentation content in ${lang}. This includes prose, code comments in examples, and diagram labels. Note: page titles (H1 headings) are generated separately and will remain in English.`;
   }