AI-written code compiled ICU Select options without validating property names, allowing inherited Object.prototype keys to bypass fallback and trigger a 500 DoS.

 import type AbstractIntlMessages from './AbstractIntlMessages.js';

 import {defaultGetMessageFallback} from './defaults.js';-import {-  type Formatters,-  type IntlCache,-  type IntlFormatters,-  type MessageFormatter,-  memoFn-} from './formatters.js';+import type {Formatters, IntlCache} from './formatters.js'; import joinPath from './joinPath.js'; -// Placed here for improved tree shaking. Somehow when this is placed in-// `formatters.tsx`, then it can't be shaken off from `next-intl`.-function createMessageFormatter(-  cache: IntlCache,-  intlFormatters: IntlFormatters-): MessageFormatter {-  const getMessageFormat = memoFn(-    (...args: ConstructorParameters<typeof IntlMessageFormat>) =>-      new IntlMessageFormat(args[0], args[1], args[2], {-        formatters: intlFormatters,-        ...args[3]-      }),-    cache.message

++    let transformed;+    if (typeof value === 'function') {+      transformed = (chunks: ReactNode) => {+        const result = value(chunks);++        return isValidElement(result)+          ? cloneElement(result, {key: key + index++})+          : result;+      };+    } else {+      transformed = value;+    }++    transformedValues[key] = transformed;+  });++  return transformedValues; }  function resolvePath(@@ -77,32 +78,6 @@ function resolvePath(

--    let transformed;-    if (typeof value === 'function') {-      transformed = (chunks: ReactNode) => {-        const result = value(chunks);--        return isValidElement(result)-          ? cloneElement(result, {key: key + index++})-          : result;-      };-    } else {-      transformed = value;-    }-

+const require = createRequire(import.meta.url); function withExtensions(localPath: string) {   return [     `${localPath}.ts`,@@ -69,6 +71,12 @@ export default function getNextConfig(   nextConfig?: NextConfig ) {   const useTurbo = process.env.TURBOPACK != null;+

   function getExtractMessagesLoaderConfig() {@@ -123,7 +131,19 @@ export default function getNextConfig(     }   } -  if (useTurbo) {+  // Validate messages config+  if (pluginConfig.experimental?.messages) {+    const messages = pluginConfig.experimental.messages;+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- For non-TS consumers+    if (!messages.format) {+      throwError('`format` is required when using `messages`.');+    }+    if (!messages.path) {+      throwError('`path` is required when using `messages`.');+    }+  }++  if (shouldConfigureTurbo) {     if (       pluginConfig.requestConfig &&       path.isAbsolute(pluginConfig.requestConfig)@@ -135,12 +155,31 @@ export default function getNextConfig(     }      // Assign alias for `next-intl/config`-    const resolveAlias = {+    const resolveAlias: Record<string, string> = {       // Turbo aliases don't work with absolute       // paths (see error handling above)       'next-intl/config': resolveI18nPath(pluginConfig.requestConfig)     }; +    // Add alias for precompiled message formatting+    if (pluginConfig.experimental?.messages?.precompile) {+      // Workaround for https://github.com/vercel/next.js/issues/88540+      let formatOnlyPath = path.relative(+        process.cwd(),+        require.resolve('use-intl/format-message/format-only')+      );++      // Turbopack seems to require this, otherwise `use-intl/format-message` is+      // still bundled (despite the code correctly calling into `format-only`).+      // Note that in this monorepo this is not necessary, because we'll end+      // up with a path like `../…` — but for actual consumers this is required.+      if (!formatOnlyPath.startsWith('.')) {+        formatOnlyPath = `./${formatOnlyPath}`;+      }++      resolveAlias['use-intl/format-message'] = formatOnlyPath;+    }+     // Add loaders     let rules: Record<string, TurbopackRuleConfigCollection> | undefined; @@ -215,7 +254,9 @@ export default function getNextConfig(         }       };     }-  } else {+  }++  if (!useTurbo) {     nextIntlConfig.webpack = function webpack(config: Configuration, context) {

   for (const message of messages) {

 export function setNestedProperty(   obj: Record<string, any>,   keyPath: string,   value: any ): void {

 +  let current = obj;   for (let i = 0; i < keys.length - 1; i++) {     const key = keys[i];     if (-      !(key in current) ||+      !Object.prototype.hasOwnProperty.call(current, key) ||       typeof current[key] !== 'object' ||       current[key] === null     ) {-      current[key] = {};+      current[key] = Object.create(null);     }     current = current[key];   }

++describe('setNestedProperty', () => {+  it('rejects __proto__ segments (prototype pollution)', () => {+    expect(() => setNestedProperty({}, '__proto__.polluted', 'x')).toThrow(+      'Invalid message id segment: __proto__'+    );+    expect(+      (Object.prototype as unknown as {polluted?: string}).polluted+    ).toBeUndefined();+  });++  it('creates plain data properties for nested paths', () => {+    const root = Object.create(null) as Record<string, unknown>;+    setNestedProperty(root, 'a.b', 1);+    expect(Object.hasOwn(root, 'a')).toBe(true);+    expect(({} as Record<string, unknown>).b).toBeUndefined();+  });+});