[BUG] [typescript-fetch] Potential JSON Injection via Object.assign

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator (example)?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?
• [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

I've encountered a potential JSON Injection vulnerability in the TypeScript-Fetch client generated by OpenAPI Generator. The issue arises due to the usage of Object.assign in runtime.mustache.

More information about the potential vulnerability:
JSON injection occurs when untrusted input is incorporated into a JavaScript object without proper validation or sanitization. When using methods like Object.assign, malicious input can override or add unintended properties to the object. Attackers may inject properties that alter the application's behavior. Validate the structure and content of input data to ensure it adheres to expected schemas. Reject inputs containing unexpected or disallowed properties.
https://owasp.org/Top10/A03_2021-Injection/

openapi-generator version

latest (7.11.0)

OpenAPI declaration file content or url

No need, since this code is in the template:
runtime.mustache

Suggest a fix

Not sure how to address it, since this code is being used to merge default configuration headers and specific request headers.
The headers can be anything, so I was wondering if we can pass a parameter to have a whitelist headers? or to have some default whitelist and allow extension of such list via parameters?

Start with modules/openapi-generator/src/main/resources/typescript-fetch/runtime.mustache around line 141 and inspect how default and request headers are merged in generated TypeScript-Fetch clients. Reproduce the reported behavior with untrusted header input, then define and verify a safe merge behavior; the issue provides no specific test file, so completion should include regression coverage for the vulnerability.