Add order keywords whitelist

lib/dialects/abstract/query-generator.js

@@ -1235,8 +1235,18 @@ module.exports = (function() {
         var mainQueryOrder = [];
         var mainQueryOrder = [];
         var subQueryOrder = [];
         var subQueryOrder = [];
 
 
+        var validateOrder = function(order) {
+          if (!_.contains(['ASC', 'DESC'], order.toUpperCase())) {
+            throw new Error(util.format('Order must be \'ASC\' or \'DESC\', \'%s\' given', order));
+          }
+        };
+
         if (Array.isArray(options.order)) {
         if (Array.isArray(options.order)) {
           options.order.forEach(function(t) {
           options.order.forEach(function(t) {
+            if (Array.isArray(t) && _.size(t) > 1) {
+              validateOrder(_.last(t));
+            }
+
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {
               subQueryOrder.push(this.quote(t, model));
               subQueryOrder.push(this.quote(t, model));
             }
             }

test/include.test.js

@@ -525,7 +525,7 @@ describe(Support.getTestDialectTeaser('Include'), function() {
             ],
             ],
             order: [
             order: [
               User.rawAttributes.id,
               User.rawAttributes.id,
-              [Product, 'id']
+              [Product, 'id', 'ASC']
             ]
             ]
           }).done(function(err, user) {
           }).done(function(err, user) {
             expect(err).not.to.be.ok;
             expect(err).not.to.be.ok;