[BUG][JAVASCRIPT] Possible Code injection in generated javascript SDK client

Description

People could provide a tampered API spec file and generate an SDK that would execute arbitrary code.

openapi-generator version

5.2.0
Took the latest master and generated artifact using it. Still saw the issue there. Sha - 75fc1383bc2

OpenAPI declaration file content or url

swagger: "2.0"
info:
    title: inactivetitle
    description: inactivedescription
    version: 1.0.0
host: api.inactive.com
basePath: /inactivebasepath/v1
schemes:
    - https
paths:
    /ioactiveapth','GET',pathParams,queryParams,headerParams,formParams,postBody,authNames,contentTypes,accepts,returnType,null,callback)&&console.log('godmode');returnType=('a:
        get:
            summary: inactivesummary
            description: inactivedescription
            produces:
                - applciation/json
            responses:
                200:
                    description: OK

Command line used for generation

./run-in-docker.sh generate -i ./petstore.yaml -g javascript -o /gen/out/javascript-petstore

Steps to reproduce

• Run the above command to generate a javascript SDK client with the given YAML file(command assumes petstore.yaml )
• Go to - javascript-petstore/src/api/ DefaultApi.js in the generated SDK artifact
• You can see injected code as shown in the screenshot below . (console.log(godmode);

return this.apiClient.callApi(
        '/ioactiveapth','GET',pathParams,queryParams,headerParams,formParams,postBody,authNames,contentTypes,accepts,returnType,null,callback)&&console.log('godmode');returnType=('a', 'GET',
        pathParams, queryParams, headerParams, formParams, postBody,
        authNames, contentTypes, accepts, returnType, null, callback
      );
    }

Related issues/PRs

No PR created yet

Suggest a fix/enhancement

No suggested fix
We need to scan the keys in our spec yaml file for possible injection. The same injection cannot be achieved via values in the YAML file. As the path is a kind of a key, I suspect this is possible

Start with the supplied OpenAPI YAML and run ./run-in-docker.sh generate -i ./petstore.yaml -g javascript -o /gen/out/javascript-petstore. Inspect javascript-petstore/src/api/DefaultApi.js and confirm how the path key reaches the generated call. Done means a tampered path key cannot execute injected JavaScript in the generated SDK.