Code injection via .arb translation files in flutter gen-l10n; check your CI and automated translation pipeline

[u/ScaryDev]

https://badranh1.medium.com/a-translation-file-can-hack-your-flutter-app-google-says-thats-not-a-vulnerability-ae175473acd3

I just discovered an issue in Flutter that may compromise your app: you can literally write Dart code in your translation files and have it execute in production.

flutter gen-l10n validates ARB resource names but not the placeholder type field, which gets dropped straight into generated Dart. A crafted type string injects arbitrary code that compiles clean and runs when the localization is called.

Not a big deal if your .arb changes get reviewed like code, but plenty of teams auto-merge translations from CI or a third-party tool with nobody reading them, and that's where it gets dangerous: a hacked translation account, a malicious translator, or a compromised vendor can inject code into .arb files that runs in your production app.

It's rare, but it can easily turn into a supply chain attack.

for example:

{
  "@@locale": "en",
  "greeting": "Hello {user}",
  "@greeting": {
    "placeholders": {
      "user": {
        "type": "Object user) { print('>>> ARBITRARY DART EXECUTED FROM A TRANSLATION FILE <<<'); return 'pwned'; } String injectedByTranslation(Object"
      }
    }
  }
}

The print will be executed normally.

Full explanation: https://badranh1.medium.com/a-translation-file-can-hack-your-flutter-app-google-says-thats-not-a-vulnerability-ae175473acd3

EDIT: The issue is reported to Google, but it was closed without a fix as they believe it poses no security risk, that is why I am posting it publicly, a nice to know.

[u/eibaan]

Nice catch. And probably not the only one AI can find in the development tools. I'd agree with Google that this is low risk because I'd consider the idea to automatically add translated arb from an untrusted source while CI a really bad one, but nevertheless, adding validation of type would be an easy patch.

[u/ScaryDev → u/eibaan]

Thanks, yes I've use AI in the research.

It is a low risk agree, depending on the setup, better fixed and be safe, I've created a Github issue the patch should be fairly simple, I'd try to create a PR and submit a patch but first need to see the rules of contribution.

[u/Acrobatic_Egg30]

Good to know.