fix: replace {} with Object.create(null) for defense-in-depth in apps engine (#40763)

Author: julio-rocketchat

.changeset/chubby-garlics-decide.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/apps': patch
+---
+
+Replaces {} with Object.create(null) to ensure defense-in-depth against prototype pollution

packages/apps/src/server/AppManager.ts

@@ -845,7 +845,7 @@ export class AppManager {
 	}
 
 	public getLanguageContent(): { [key: string]: object } {
-		const langs: { [key: string]: object } = {};
+		const langs: { [key: string]: object } = Object.create(null);
 
 		this.apps.forEach((rl) => {
 			const content = rl.getStorageItem().languageContent;

packages/apps/src/server/compiler/AppPackageParser.ts

@@ -93,7 +93,7 @@ export class AppPackageParser {
 	}
 
 	private getLanguageContent(zip: AdmZip): { [key: string]: object } {
-		const languageContent: { [key: string]: object } = {};
+		const languageContent: { [key: string]: object } = Object.create(null);
 
 		zip
 			.getEntries()