[Security] Dynamic `import()` in translation manager accepts unsanitized language codes — path traversal risk

[RUKAYAT-CODER]

Overview

src/locales/translationManager.ts line 30 performs await import(\./\.json\) where language comes directly from user-supplied input. An attacker can pass ../../lib/secrets as the language code and potentially load arbitrary modules or files on the server.

Specifications

Features:

• Language codes are validated against a strict allowlist before any dynamic import
• Unsupported language codes fall back to English without performing the import

Tasks:

• Before the dynamic import, validate: if (!SUPPORTED_LANGUAGES.includes(language)) { language = DEFAULT_LANGUAGE; }
• Ensure SUPPORTED_LANGUAGES is an exhaustive array of ISO 639-1 codes
• Add a test asserting that a path-traversal string like ../../etc/passwd falls back to English
• Consider using a static import map instead of dynamic imports

Impacted Files:

• src/locales/translationManager.ts
• src/locales/config.ts

Acceptance Criteria

• Language codes not in SUPPORTED_LANGUAGES do not trigger a dynamic import
• Path traversal strings are rejected before any file system access
• Fallback to English occurs gracefully for unsupported locales

[smartalee]

@smartalee has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would love to work on this pls 🙌

ℹ️ Repo Maintainers: To accept this application, review their application or assign @smartalee to this issue.

[Caneryy]

@Caneryy has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello, I'd like to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Caneryy to this issue.

[veloura-dev]

@veloura-dev has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Please maintainer..I can handle this professionally and make sure this issue is closed ASAP WITHOUT ERRORS. EXPECT PR ASAP

ℹ️ Repo Maintainers: To accept this application, review their application or assign @veloura-dev to this issue.

[drips-wave]

Congratulations, @smartalee! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @smartalee: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊