Implement 3 code review recommendations: security fix, translations, and technical debt tracking

Co-authored-by: squassina <8495707+squassina@users.noreply.github.com>

TECHNICAL_DEBT.md

@@ -0,0 +1,143 @@
+# Technical Debt Tracking
+
+This document tracks known technical debt items (TODO/FIXME comments) in the 
+MangoWC codebase. These items represent future improvements or issues that need 
+investigation but don't block current functionality.
+
+**Status:** All items are non-critical. The code functions correctly despite 
+these notes.
+
+---
+
+## TODO Items
+
+### 1. Mouse Bindings: Scroll Wheel Support
+
+**Location:** `src/mango.c:1803-1804`
+
+**Current Code:**
+```c
+/* TODO: allow usage of scroll whell for mousebindings, it can be
+ * implemented checking the event's orientation and the delta of the event
+```
+
+**Description:** 
+Mouse bindings currently don't support scroll wheel events. Implementation would 
+require checking the event's orientation and delta values.
+
+**Priority:** Low  
+**Estimated Effort:** Medium (2-4 hours)  
+**Impact:** Quality of life improvement for users wanting scroll-based keybindings
+
+---
+
+### 2. Input Device Type Support
+
+**Location:** `src/mango.c:3537`
+
+**Current Code:**
+```c
+/* TODO handle other input device types */
+```
+
+**Description:** 
+The input device handling code may not support all input device types. Current 
+implementation covers keyboard, pointer, touch, tablet, and switch devices, but 
+there may be edge cases or newer device types not yet handled.
+
+**Priority:** Low  
+**Estimated Effort:** Small-Medium (1-3 hours)  
+**Impact:** Better support for specialized input devices
+
+---
+
+### 3. Cursor Requirement Question
+
+**Location:** `src/mango.c:3545`
+
+**Current Code:**
+```c
+/* TODO do we actually require a cursor? */
+```
+
+**Description:** 
+Question about whether a cursor is always required in the compositor. This may 
+relate to headless or server-only configurations where a cursor might not be 
+needed.
+
+**Priority:** Very Low  
+**Estimated Effort:** Research + potential refactor (variable)  
+**Impact:** Could enable headless compositor configurations
+
+---
+
+### 4. Cursor Initial Position Hack
+
+**Location:** `src/mango.c:4782-4783`
+
+**Current Code:**
+```c
+/* TODO hack to get cursor to display in its initial location (100, 100)
+ * instead of (0, 0) and then jumping. still may not be fully
+```
+
+**Description:** 
+Current implementation uses a workaround to position the cursor at (100, 100) 
+instead of (0, 0) to avoid a visual jump. This is marked as a hack that should 
+be properly fixed.
+
+**Priority:** Low  
+**Estimated Effort:** Medium (requires investigation + fix, 3-6 hours)  
+**Impact:** Minor cosmetic improvement during startup
+
+---
+
+## FIXME Items
+
+### 5. Cursor Position After Monitor Power On
+
+**Location:** `src/mango.c:5982-5983`
+
+**Current Code:**
+```c
+/* FIXME: figure out why the cursor image is at 0,0 after turning all
+ * the monitors on.
+```
+
+**Description:** 
+After turning all monitors on, the cursor image appears at position (0, 0) 
+instead of maintaining its previous position. Root cause is not yet understood.
+
+**Priority:** Medium  
+**Estimated Effort:** Medium-Large (requires debugging, 4-8 hours)  
+**Impact:** User experience issue when recovering from monitor power-off state
+
+---
+
+## How to Contribute
+
+If you're interested in addressing any of these items:
+
+1. **Research:** Investigate the issue thoroughly
+2. **Discuss:** Open a GitHub issue to discuss your approach
+3. **Implement:** Create a PR with your fix
+4. **Test:** Ensure the fix doesn't introduce regressions
+5. **Update:** Remove the item from this document and the source code comment
+
+---
+
+## Statistics
+
+- **Total Items:** 5
+- **TODO Items:** 4
+- **FIXME Items:** 1
+- **Priority Breakdown:**
+  - Very Low: 1
+  - Low: 3
+  - Medium: 1
+  - High: 0
+
+---
+
+**Last Updated:** 2026-02-19  
+**Documented By:** Code Review Process

meson.build

@@ -15,16 +15,16 @@ endif
 prefix = get_option('prefix')
 sysconfdir = get_option('sysconfdir')
 
-# 如果 sysconfdir 以 prefix 开头，去掉 prefix
+# If sysconfdir starts with prefix, remove prefix
 if sysconfdir.startswith(prefix) and not is_nixos
   sysconfdir = sysconfdir.substring(prefix.length())
-  # 确保 sysconfdir 是绝对路径
+  # Ensure sysconfdir is an absolute path
   if not sysconfdir.startswith('/')
     sysconfdir = '/' + sysconfdir
   endif
 endif
 
-# 打印调试信息，确认 sysconfdir 的值
+# Print debug information to confirm sysconfdir value
 # message('prefix: ' + prefix)
 # message('sysconfdir: ' + sysconfdir)
 
@@ -41,11 +41,11 @@ pcre2_dep = dependency('libpcre2-8')
 libscenefx_dep = dependency('scenefx-0.4',version: '>=0.4.1')
 
 
-# 获取版本信息
+# Get version information
 git = find_program('git', required : false)
 is_git_repo = false
 
-# 检查当前目录是否是 Git 仓库
+# Check if current directory is a Git repository
 if git.found()
   git_status = run_command(git, 'rev-parse', '--is-inside-work-tree', check : false)
   if git_status.returncode() == 0 and git_status.stdout().strip() == 'true'
@@ -54,18 +54,18 @@ if git.found()
 endif
 
 if is_git_repo
-  # 如果是 Git 目录，获取 Commit Hash 和最新的 tag
+  # If in Git directory, get Commit Hash and latest tag
   commit_hash = run_command(git, 'rev-parse', '--short', 'HEAD', check : false).stdout().strip()
   latest_tag = meson.project_version()
   version_with_hash = '@0@(@1@)'.format(latest_tag, commit_hash)
 else
-  # 如果不是 Git 目录，使用项目版本号和 "release" 字符串
+  # If not in Git directory, use project version number and "release" string
   commit_hash = 'release'
   latest_tag = meson.project_version()
   version_with_hash = '@0@(@1@)'.format(latest_tag, commit_hash)
 endif
 
-# 定义编译参数
+# Define compilation arguments
 c_args = [
   '-g',
   '-Wno-unused-function',
@@ -75,7 +75,7 @@ c_args = [
   '-DSYSCONFDIR="@0@"'.format('/etc'),
 ]
 
-# 仅在 debug 选项启用时添加调试参数
+# Only add debug arguments when debug option is enabled
 if get_option('asan')
   c_args += [
     '-fsanitize=address',
@@ -88,7 +88,7 @@ if xcb.found() and xlibs.found()
   c_args += '-DXWAYLAND'
 endif
 
-# 链接参数（根据 debug 状态添加 ASAN）
+# Link arguments (add ASAN based on debug state)
 link_args = []
 if get_option('asan')
   link_args += '-fsanitize=address'

src/dispatch/bind_define.h

@@ -843,7 +843,7 @@ int32_t spawn(const Arg *arg) {
 		char *token = strtok((char *)arg->v, " ");
 		while (token != NULL && argc < 63) {
 			wordexp_t p;
-			if (wordexp(token, &p, 0) == 0 && p.we_wordc > 0) {
+			if (wordexp(token, &p, WRDE_NOCMD) == 0 && p.we_wordc > 0) {
 				// Duplicate the string since we'll free the wordexp result
 				argv[argc] = strdup(p.we_wordv[0]);
 				wordfree(&p); // Free immediately after copying
@@ -1591,8 +1591,9 @@ int32_t toggleoverview(const Arg *arg) {
 		return 0;
 	}
 
-	// Normal view to overview, exit all floating and fullscreen states to participate in tiling,
-	// Overview to normal view, restore previously exited floating and fullscreen window states
+	// Normal view to overview, exit all floating and fullscreen states to
+	// participate in tiling, Overview to normal view, restore previously exited
+	// floating and fullscreen window states
 	if (selmon->isoverview) {
 		wl_list_for_each(c, &clients, link) {
 			if (c && c->mon == selmon && !client_is_unmanaged(c) &&