fix: validate languages (#3638)

web/i18n/server.ts

@@ -46,6 +46,12 @@ export const getLocaleOnServer = (): Locale => {
     languages = new Negotiator({ headers: negotiatorHeaders }).languages()
   }
 
+  // Validate languages
+  if (!Array.isArray(languages) || languages.length === 0 || !languages.every(lang => typeof lang === 'string' && /^[\w-]+$/.test(lang))) {
+    console.error(`Invalid languages: ${languages}`)
+    languages = [i18n.defaultLocale]
+  }
+
   // match locale
   const matchedLocale = match(languages, locales, i18n.defaultLocale) as Locale
   return matchedLocale