1 files changed, 9 insertions, 0 deletions
diff --git a/talermerchantdemos/httpcommon/__init__.py b/talermerchantdemos/httpcommon/__init__.py
index 0b76111..56cfeda 100644
--- a/talermerchantdemos/httpcommon/__init__.py
+++ b/talermerchantdemos/httpcommon/__init__.py
@@ -5,6 +5,7 @@ from flask import request, url_for
 from datetime import datetime
 import time
 from flask_babel import gettext
+import babel # used for lang sanity check
 import os
 import re
 import logging
@@ -99,6 +100,14 @@ def get_locale():
         # Totally unexpected path format, do not localize
         return "en"
     lang = parts[1]
+
+    # Sanity check on the language code.
+    try:
+        babel.core.Locale.parse(lang)
+    except Exception as err:
+        # Not a locale, default to english.
+        LOGGER.error(f"language {lang} did not parse, default to english")
+        return "en"
     if lang == "static":
         # Static resource, not a language indicator.
         # Do not localize then.