add tests for order validation

lib/dialects/abstract/query-generator.js

@@ -1272,7 +1272,13 @@ module.exports = (function() {
         if (Array.isArray(options.order)) {
         if (Array.isArray(options.order)) {
           options.order.forEach(function(t) {
           options.order.forEach(function(t) {
             if (Array.isArray(t) && _.size(t) > 1) {
             if (Array.isArray(t) && _.size(t) > 1) {
-              validateOrder(_.last(t));
+              if (t[0] instanceof Model || t[0].model instanceof Model) {
+                if (typeof t[t.length - 2] === "string") {
+                  validateOrder(_.last(t));
+                }
+              } else {
+                validateOrder(_.last(t));
+              }
             }
             }
 
 
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {

test/include.test.js

@@ -525,7 +525,7 @@ describe(Support.getTestDialectTeaser('Include'), function() {
             ],
             ],
             order: [
             order: [
               User.rawAttributes.id,
               User.rawAttributes.id,
-              [Product, 'id', 'ASC']
+              [Product, 'id']
             ]
             ]
           }).done(function(err, user) {
           }).done(function(err, user) {
             expect(err).not.to.be.ok;
             expect(err).not.to.be.ok;

test/model/findAll/order.test.js

@@ -69,6 +69,45 @@ describe(Support.getTestDialectTeaser('Model'), function() {
           });
           });
         }
         }
       });
       });
+
+      describe.only('injections', function () {
+        beforeEach(function () {
+          this.User = this.sequelize.define('user', {
+
+          });
+          this.Group = this.sequelize.define('group', {
+
+          });
+          this.User.belongsTo(this.Group);
+          return this.sequelize.sync({force: true});
+        });
+
+        it('should throw when 2nd order argument is not ASC or DESC', function () {
+          return expect(this.User.findAll({
+            order: [
+              ['id', ';DELETE YOLO INJECTIONS']
+            ]
+          })).to.eventually.be.rejectedWith(Error, 'Order must be \'ASC\' or \'DESC\', \';DELETE YOLO INJECTIONS\' given');
+        });
+
+        it('should throw with include when last order argument is not ASC or DESC', function () {
+          return expect(this.User.findAll({
+            include: [this.Group],
+            order: [
+              [this.Group, 'id', ';DELETE YOLO INJECTIONS']
+            ]
+          })).to.eventually.be.rejectedWith(Error, 'Order must be \'ASC\' or \'DESC\', \';DELETE YOLO INJECTIONS\' given');
+        });
+
+        it('should not throw with include when last order argument is a field', function () {
+          return this.User.findAll({
+            include: [this.Group],
+            order: [
+              [this.Group, 'id']
+            ]
+          });
+        });
+      });
     });
     });
   });
   });
 });
 });
\ No newline at end of file