MAGETWO-88642: Sort Order Field Values

Author: Oleksandr Gorkun

lib/internal/Magento/Framework/Api/SortOrder.php

@@ -30,6 +30,9 @@ public function __construct(array $data = [])
         if (null !== $this->getDirection()) {
             $this->validateDirection($this->getDirection());
         }
+        if ($this->getField() !== null) {
+            $this->validateField($this->getField());
+        }
     }
 
     /**
@@ -50,6 +53,8 @@ public function getField()
      */
     public function setField($field)
     {
+        $this->validateField($field);
+
         return $this->setData(SortOrder::FIELD, $field);
     }
 
@@ -127,4 +132,23 @@ private function normalizeDirectionInput($direction)
     {
         return strtoupper($direction);
     }
+
+    /**
+     * Check if given value can be used as sorting field.
+     *
+     * @param string $field
+     * @return void
+     * @throws InputException
+     */
+    private function validateField(string $field): void
+    {
+        if (preg_match('/[^a-z0-9\_]/i', $field)) {
+            throw new InputException(
+                new Phrase(
+                    'Sort order field %1 contains restricted symbols',
+                    [$field]
+                )
+            );
+        }
+    }
 }

lib/internal/Magento/Framework/Api/Test/Unit/SortOrderTest.php

@@ -86,4 +86,14 @@ public function testItValidatesADirectionAssignedDuringInstantiation()
             SortOrder::DIRECTION => 'not-asc-or-desc'
         ]);
     }
+
+    /**
+     * @expectedException \Magento\Framework\Exception\InputException
+     */
+    public function testValidateField()
+    {
+        $this->sortOrder = new SortOrder([
+            SortOrder::FIELD => 'invalid field (value);'
+        ]);
+    }
 }