Security fixes (#125)

Author: lucasdillmann

CHANGELOG.md

@@ -1,5 +1,10 @@
 # CHANGELOG
 
+## 2.40.1
+
+- Security fixes (thanks @tonghuaroot for 
+  [the report](https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx)!)
+
 ## 2.40.0
 
 - Users can now update their own name and username from the account settings modal in the shell header.

api/common/server/i18n.go

@@ -2,18 +2,25 @@ package server
 
 import (
 	"context"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	"golang.org/x/text/language"
 
 	"dillmann.com.br/nginx-ignition/core/common/i18n"
 )
 
+const maximumLanguageTags = 10
+
 func i18nMiddleware(commands i18n.Commands) gin.HandlerFunc {
 	return func(ginCtx *gin.Context) {
 		lang := commands.DefaultLanguage()
 
 		langHeader := ginCtx.GetHeader("Accept-Language")
+		if strings.Count(langHeader, "-")+strings.Count(langHeader, "_") > maximumLanguageTags {
+			langHeader = ""
+		}
+
 		tags, _, err := language.ParseAcceptLanguage(langHeader)
 		if err == nil && len(tags) > 0 {
 			for _, tag := range tags {