1 files changed, 30 insertions, 9 deletions

diff --git a/lib/private/L10N/Factory.php b/lib/private/L10N/Factory.php
index eb84f264f5f..6a747744829 100644
--- a/lib/private/L10N/Factory.php
+++ b/lib/private/L10N/Factory.php
@@ -108,9 +108,7 @@ class Factory implements IFactory {
 				$locale = $forceLocale;
 			}
 
-			if ($lang === null || !$this->languageExists($app, $lang)) {
-				$lang = $this->findLanguage($app);
-			}
+			$lang = $this->validateLanguage($app, $lang);
 
 			if ($locale === null || !$this->localeExists($locale)) {
 				$locale = $this->findLocale($lang);
@@ -131,6 +129,29 @@ class Factory implements IFactory {
 	}
 
 	/**
+	 * Check that $lang is an existing language and not null, otherwise return the language to use instead
+	 *
+	 * @psalm-taint-escape callable
+	 * @psalm-taint-escape cookie
+	 * @psalm-taint-escape file
+	 * @psalm-taint-escape has_quotes
+	 * @psalm-taint-escape header
+	 * @psalm-taint-escape html
+	 * @psalm-taint-escape include
+	 * @psalm-taint-escape ldap
+	 * @psalm-taint-escape shell
+	 * @psalm-taint-escape sql
+	 * @psalm-taint-escape unserialize
+	 */
+	private function validateLanguage(string $app, ?string $lang): string {
+		if ($lang === null || !$this->languageExists($app, $lang)) {
+			return $this->findLanguage($app);
+		} else {
+			return $lang;
+		}
+	}
+
+	/**
 	 * Find the best language
 	 *
 	 * @param string|null $appId App id or null for core
@@ -416,8 +437,8 @@ class Factory implements IFactory {
 			}
 
 			// Use language from request
-			if ($this->userSession->getUser() instanceof IUser &&
-				$user->getUID() === $this->userSession->getUser()->getUID()) {
+			if ($this->userSession->getUser() instanceof IUser
+				&& $user->getUID() === $this->userSession->getUser()->getUID()) {
 				try {
 					return $this->getLanguageFromRequest();
 				} catch (LanguageNotFoundException $e) {
@@ -496,10 +517,10 @@ class Factory implements IFactory {
 		// use formal version of german ("Sie" instead of "Du") if the default
 		// language is set to 'de_DE' if possible
 		if (
-			is_string($defaultLanguage) &&
-			strtolower($lang) === 'de' &&
-			strtolower($defaultLanguage) === 'de_de' &&
-			$this->languageExists($app, 'de_DE')
+			is_string($defaultLanguage)
+			&& strtolower($lang) === 'de'
+			&& strtolower($defaultLanguage) === 'de_de'
+			&& $this->languageExists($app, 'de_DE')
 		) {
 			$result = 'de_DE';
 		}