Merge branch 'seegno-bugfix/whitelist-order-keywords'

lib/dialects/abstract/query-generator.js

@@ -1263,8 +1263,24 @@ module.exports = (function() {
         var mainQueryOrder = [];
         var mainQueryOrder = [];
         var subQueryOrder = [];
         var subQueryOrder = [];
 
 
+        var validateOrder = function(order) {
+          if (!_.contains(['ASC', 'DESC'], order.toUpperCase())) {
+            throw new Error(util.format('Order must be \'ASC\' or \'DESC\', \'%s\' given', order));
+          }
+        };
+
         if (Array.isArray(options.order)) {
         if (Array.isArray(options.order)) {
           options.order.forEach(function(t) {
           options.order.forEach(function(t) {
+            if (Array.isArray(t) && _.size(t) > 1) {
+              if (t[0] instanceof Model || t[0].model instanceof Model) {
+                if (typeof t[t.length - 2] === "string") {
+                  validateOrder(_.last(t));
+                }
+              } else {
+                validateOrder(_.last(t));
+              }
+            }
+
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {
               subQueryOrder.push(this.quote(t, model));
               subQueryOrder.push(this.quote(t, model));
             }
             }

test/model/findAll/order.test.js

@@ -69,6 +69,45 @@ describe(Support.getTestDialectTeaser('Model'), function() {
           });
           });
         }
         }
       });
       });
+
+      describe.only('injections', function () {
+        beforeEach(function () {
+          this.User = this.sequelize.define('user', {
+
+          });
+          this.Group = this.sequelize.define('group', {
+
+          });
+          this.User.belongsTo(this.Group);
+          return this.sequelize.sync({force: true});
+        });
+
+        it('should throw when 2nd order argument is not ASC or DESC', function () {
+          return expect(this.User.findAll({
+            order: [
+              ['id', ';DELETE YOLO INJECTIONS']
+            ]
+          })).to.eventually.be.rejectedWith(Error, 'Order must be \'ASC\' or \'DESC\', \';DELETE YOLO INJECTIONS\' given');
+        });
+
+        it('should throw with include when last order argument is not ASC or DESC', function () {
+          return expect(this.User.findAll({
+            include: [this.Group],
+            order: [
+              [this.Group, 'id', ';DELETE YOLO INJECTIONS']
+            ]
+          })).to.eventually.be.rejectedWith(Error, 'Order must be \'ASC\' or \'DESC\', \';DELETE YOLO INJECTIONS\' given');
+        });
+
+        it('should not throw with include when last order argument is a field', function () {
+          return this.User.findAll({
+            include: [this.Group],
+            order: [
+              [this.Group, 'id']
+            ]
+          });
+        });
+      });
     });
     });
   });
   });
 });
 });
\ No newline at end of file