Potential fix for code scanning alert no. 2: Uncontrolled data used in path expression

[ilesinge]

Potential fix for https://github.com/ilesinge/shabda/security/code-scanning/2

To fix the problem, sanitize and validate the language argument before using it in the file path. The best approach, given its use as part of a filename, is either to restrict it to a safe set of values or ensure only safe characters are included. For this use-case, we can eliminate any directory traversal (/, \, or ..) and restrict to a simple whitelist (e.g., letters, digits, underscore, dash), or use werkzeug.utils.secure_filename or a similar utility for ensuring the segment is safe for file use.

Specifically, edit the speak method in shabda/dj.py to sanitize language (and potentially word and gender similarly). You can do this using a regular expression or by filtering out unwanted characters. Since only language is tainted in the trace, we must at least sanitize it before constructing the file path. Add the necessary imports.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.