fix by review

Author: dmlvr

packages/devextreme/js/__internal/core/utils/m_data.ts

@@ -70,12 +70,15 @@ export const compileGetter = function (expr) {
     const path = getPathParts(expr);
     const unsafeFragment = path.find(isUnsafePathFragment);
 
-    return function (obj, options) {
-      if (unsafeFragment !== undefined) {
+    if (unsafeFragment !== undefined) {
+      return function () {
         errors.log('E0123', unsafeFragment);
+        // eslint-disable-next-line no-useless-return
         return;
-      }
+      };
+    }
 
+    return function (obj, options) {
       options = prepareOptions(options);
       const functionAsIs = options.functionsAsIs;
       const hasDefaultValue = 'defaultValue' in options;
@@ -179,6 +182,8 @@ export const compileSetter = function (expr) {
   if (unsafeFragment !== undefined) {
     return function () {
       errors.log('E0123', unsafeFragment);
+      // eslint-disable-next-line no-useless-return
+      return;
     };
   }
 

packages/devextreme/testing/tests/DevExpress.core/utils.data.tests.js

@@ -527,7 +527,24 @@ QUnit.module('prototype pollution protection', {
         assert.strictEqual(errors.log.called, false, 'should not log for safe paths');
     });
 
-    test('compileGetter logs error and returns undefined for __proto__ path fragment (T1330839)', function(assert) {
+    test('compileSetter blocks unsafe fragment written in bracket notation (T1330839)', function(assert) {
+        const obj = {};
+        SETTER('a[constructor][prototype].pp_dx')(obj, 'yes', { functionsAsIs: true });
+
+        assert.strictEqual(errors.log.calledWith('E0123', 'constructor'), true, 'should log E0123 for constructor in bracket notation');
+        assert.strictEqual(({}).pp_dx, undefined, 'Object.prototype must not be polluted');
+    });
+
+    test('compileSetter blocks unsafe fragment in non-first position (T1330839)', function(assert) {
+        const obj = { a: { b: {} } };
+        SETTER('a.b.__proto__')(obj, { pp_dx: 'yes' }, { functionsAsIs: true });
+
+        assert.strictEqual(errors.log.calledWith('E0123', '__proto__'), true, 'should log E0123 for __proto__ in non-first position');
+        assert.strictEqual(obj.a.b.pp_dx, undefined, 'nested object must not inherit a polluted property');
+        assert.strictEqual(({}).pp_dx, undefined, 'Object.prototype must not be polluted');
+    });
+
+    test('compileGetter logs error and returns undefined for __proto__ path fragent (T1330839)', function(assert) {
         const result = GETTER('__proto__.pp_dx')({});
 
         assert.strictEqual(errors.log.calledWith('E0123', '__proto__'), true, 'should log E0123 for __proto__');