Merge branch 'MAGETWO-88642' into 2.3-bugfixes-290618

Author: Dmytro Voskoboinikov

lib/internal/Magento/Framework/Api/SortOrder.php

@@ -25,13 +25,17 @@ class SortOrder extends AbstractSimpleObject
      * Initialize object and validate sort direction
      *
      * @param array $data
+     * @throws InputException
      */
     public function __construct(array $data = [])
     {
         parent::__construct($data);
         if (null !== $this->getDirection()) {
             $this->validateDirection($this->getDirection());
         }
+        if ($this->getField() !== null) {
+            $this->validateField($this->getField());
+        }
     }
 
     /**
@@ -48,10 +52,14 @@ public function getField()
      * Set sorting field.
      *
      * @param string $field
+     * @throws InputException
+     *
      * @return $this
      */
     public function setField($field)
     {
+        $this->validateField($field);
+
         return $this->setData(SortOrder::FIELD, $field);
     }
 
@@ -69,6 +77,8 @@ public function getDirection()
      * Set sorting direction.
      *
      * @param string $direction
+     * @throws InputException
+     *
      * @return $this
      */
     public function setDirection($direction)
@@ -81,10 +91,10 @@ public function setDirection($direction)
      * Validate direction argument ASC or DESC
      *
      * @param mixed $direction
-     * @return null
+     * @return void
      * @throws InputException
      */
-    private function validateDirection($direction)
+    private function validateDirection($direction): void
     {
         $this->validateDirectionIsString($direction);
         $this->validateDirectionIsAscOrDesc($direction);
@@ -93,9 +103,9 @@ private function validateDirection($direction)
     /**
      * @param string $direction
      * @throws InputException
-     * @return null
+     * @return void
      */
-    private function validateDirectionIsString($direction)
+    private function validateDirectionIsString($direction): void
     {
         if (!is_string($direction)) {
             throw new InputException(new Phrase(
@@ -108,9 +118,9 @@ private function validateDirectionIsString($direction)
     /**
      * @param string $direction
      * @throws InputException
-     * @return null
+     * @return void
      */
-    private function validateDirectionIsAscOrDesc($direction)
+    private function validateDirectionIsAscOrDesc($direction): void
     {
         $normalizedDirection = $this->normalizeDirectionInput($direction);
         if (!in_array($normalizedDirection, [SortOrder::SORT_ASC, SortOrder::SORT_DESC], true)) {
@@ -129,4 +139,23 @@ private function normalizeDirectionInput($direction)
     {
         return strtoupper($direction);
     }
+
+    /**
+     * Check if given value can be used as sorting field.
+     *
+     * @param string $field
+     * @return void
+     * @throws InputException
+     */
+    private function validateField(string $field): void
+    {
+        if (preg_match('/[^a-z0-9\_]/i', $field)) {
+            throw new InputException(
+                new Phrase(
+                    'Sort order field %1 contains restricted symbols',
+                    [$field]
+                )
+            );
+        }
+    }
 }

lib/internal/Magento/Framework/Api/Test/Unit/SortOrderTest.php

@@ -92,4 +92,14 @@ public function testItValidatesADirectionAssignedDuringInstantiation()
             SortOrder::DIRECTION => 'not-asc-or-desc'
         ]);
     }
+
+    /**
+     * @expectedException \Magento\Framework\Exception\InputException
+     */
+    public function testValidateField()
+    {
+        $this->sortOrder = new SortOrder([
+            SortOrder::FIELD => 'invalid field (value);'
+        ]);
+    }
 }