Merge pull request #4 from rockenman1234/docs

add mark fixes

trustgraph-base/trustgraph/i18n/__init__.py

@@ -98,11 +98,14 @@ def normalize_language(value: Optional[str]) -> str:
     return "en"
 
 
+# Returns a mutable object - caller must not mutate!
 @lru_cache(maxsize=32)
 def get_language_pack(language: str) -> Dict[str, str]:
     """Load the language pack for `language` from package resources."""
 
     lang = normalize_language(language)
+    if lang not in SUPPORTED_LANGUAGES:
+        lang = "en"
 
     try:
         with importlib_resources.open_text(

trustgraph-flow/trustgraph/gateway/endpoint/i18n.py

@@ -40,6 +40,12 @@ class I18nPackEndpoint:
             return web.HTTPUnauthorized()
 
         lang = request.match_info.get("lang") or "en"
+
+        # This is a path traversal defense, and is a critical sec defense.
+        # Do not remove!
+        if "/" in lang or ".." in lang:
+            return web.HTTPBadRequest(reason="Invalid language code")
+
         pack = get_language_pack(lang)
 
         return web.json_response(pack)

trustgraph/trustgraph/trustgraph_version.py

@@ -1 +0,0 @@
-__version__ = "2.2.999"