fix(treesitter): validate language name

Problem: Some injections (like markdown) allow specifying arbitrary
language names for code blocks, which may be lead to errors when
looking for a corresponding parser in runtime path.

Solution: Validate that the language name only contains alphanumeric
characters and `_` (e.g., for `c_sharp`) and error otherwise.

1 files changed, 9 insertions, 3 deletions

diff --git a/runtime/lua/vim/treesitter/language.lua b/runtime/lua/vim/treesitter/language.lua
index c92d63b8c4..8634e53b7b 100644
--- a/runtime/lua/vim/treesitter/language.lua
+++ b/runtime/lua/vim/treesitter/language.lua
@@ -6,7 +6,7 @@ local M = {}
 ---
 --- Parsers are searched in the `parser` runtime directory, or the provided {path}
 ---
----@param lang string Language the parser should parse
+---@param lang string Language the parser should parse (alphanumerical and `_` only)
 ---@param path (string|nil) Optional path the parser is located at
 ---@param silent (boolean|nil) Don't throw an error if language not found
 ---@param symbol_name (string|nil) Internal symbol name for the language to load
@@ -16,13 +16,19 @@ function M.require_language(lang, path, silent, symbol_name)
     return true
   end
   if path == nil then
-    local fname = 'parser/' .. vim.fn.fnameescape(lang) .. '.*'
+    if not (lang and lang:match('[%w_]+') == lang) then
+      if silent then
+        return false
+      end
+      error("'" .. lang .. "' is not a valid language name")
+    end
+
+    local fname = 'parser/' .. lang .. '.*'
     local paths = a.nvim_get_runtime_file(fname, false)
     if #paths == 0 then
       if silent then
         return false
       end
-
       error("no parser for '" .. lang .. "' language, see :help treesitter-parsers")
     end
     path = paths[1]