Locale: prevent prototype pollution

[chluo1997]

Describe the bug

The below updateLocaleOption() function uses key as the object index without sanitizing its value. If key is assigned to __proto__ during the execution of unsafe application code, prototype pollution occurs. See prototype pollution.

const updateLocaleOption = (key, value, locale) => {
    localeOptions(locale)[key] = value;
};

Suggested patches:

It is recommended to blacklist attack payloads assigned to key

const updateLocaleOption = (key, value, locale) => {
+  if (key.includes('__proto__') || key.includes('prototype')) {
+      throw new Error('Unsafe key detected');
+  }
    localeOptions(locale)[key] = value;
};

Reproducer

No response

PrimeReact version

10.6.3

React version

18.x

Language

TypeScript

Build / Runtime

Create React App (CRA)

Browser(s)

No response

Steps to reproduce the behavior

No response

Expected behavior

No response

[melloware]

See my PR I had to defend it in a few more spots in Locale.

[chluo1997]

See my PR I had to defend it in a few more spots in Locale.

That is great!

[melloware]

Thanks for the heads up!