flutter gen-l10n does not validate placeholder type, allowing code injection into generated Dart from .arb files #192130

Steps to reproduce

1. Create a new app: flutter create bug
2. Enable generation in pubspec.yaml (flutter: generate: true) and add an
   l10n.yaml + lib/l10n/app_en.arb as per the standard localization setup.
3. In app_en.arb, set a placeholder's type attribute to a crafted string
   that closes the generated method and injects a new member (see Code sample).
4. Run flutter gen-l10n.
5. Inspect the generated app_localizations_en.dart.
6. Run dart analyze on the generated output.

Reproduced on Flutter web and on a physical device (Pixel 6a, Android 16).

Expected results

flutter gen-l10n should validate the placeholder type attribute the same
way it already validates resource names (which are checked against
_isValidGetterAndMethodName). An illegal type value should raise an
L10nException and fail generation, rather than being written into source.

Ideally the supported types would be allowlisted (String, int, double, num,
DateTime, Object, plus the documented numeric/date format types).

Actual results

The placeholder type is read as a raw, unchecked string
(gen_l10n_types.dart:235) and interpolated into the generated method
signature (gen_l10n.dart:130, generateMethodParameters). A crafted type
string closes the generated method early, injects arbitrary members, and
reopens a declaration to absorb the remainder of the template.

The resulting file is valid Dart: it compiles, and dart analyze reports
"No issues found." The injected code executes whenever the corresponding
localization getter is called (e.g. AppLocalizations.of(context).greeting(...)).

The tool applies the exact identifier check it needs to the resource name
but not to the sibling type field that ends up in the same generated source.

Code sample

app_en.arb:

{
  "@@locale": "en",
  "greeting": "Hello {user}",
  "@greeting": {
    "placeholders": {
      "user": {
        "type": "Object user) { print('>>> ARBITRARY DART EXECUTED FROM A TRANSLATION FILE <<<'); return 'pwned'; } String injectedByTranslation(Object"
      }
    }
  }
}

Generated app_localizations_en.dart after flutter gen-l10n:

class AppLocalizationsEn extends AppLocalizations {
  AppLocalizationsEn([String locale = 'en']) : super(locale);

  @override
  String greeting(Object user) {
    print('>>> ARBITRARY DART EXECUTED FROM A TRANSLATION FILE <<<'); // injected
    return 'pwned';
  }

  String injectedByTranslation(Object user) { // injected member
    return 'Hello $user';
  }
}

dart analyze on the generated file returns "No issues found!".

Screenshots or Video

Logs

No response

Flutter Doctor output

N/A