fix(feat): Prototype Pollution Vulnerability in Mozilla FxA Account Management

[odaysec]

fxa/packages/fxa-settings/src/models/Account.ts

Line 1359 in 523ccc8

legacyLocalStorageAccount.metricsEnabled = state === 'in';

fix the issue need to prevent prototype pollution by ensuring that user-controlled keys cannot include dangerous values like __proto__, constructor, or prototype. This can be achieved by validating or sanitizing the keys before they are used in the accounts object. Specifically:

1. Modify the currentAccount() function in packages/fxa-settings/src/lib/cache.ts to validate the forceUid and account.uid keys before using them.
2. Reject or sanitize any keys that could lead to prototype pollution.

References

Object.prototype.proto
Map
CWE-78
CWE-79
CWE-94
CWE-400
CWE-471
CWE-915

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

[chenba]

@odaysec this PR includes the changes from #18812, which is causing failures in our CI. Please fix the earlier changes or remove them from this PR. Thanks.