Properly fix input sanitation for order parameters

Refs #388

Author: curry684

src/DataTable.php

@@ -60,6 +60,7 @@ class DataTable
     public const DEFAULT_TEMPLATE = '@DataTables/datatable_html.html.twig';
     public const SORT_ASCENDING = 'asc';
     public const SORT_DESCENDING = 'desc';
+    public const SORT_OPTIONS = [self::SORT_ASCENDING, self::SORT_DESCENDING];
 
     protected ?AdapterInterface $adapter = null;
 
@@ -174,10 +175,11 @@ public function addOrderBy($column, string $direction = self::SORT_ASCENDING)
         if (!$column instanceof AbstractColumn) {
             $column = is_int($column) ? $this->getColumn($column) : $this->getColumnByName((string) $column);
         }
-        if (false !== $this->getOption('ordering')) {
-            $direction = self::SORT_ASCENDING === mb_strtolower($direction) ? self::SORT_ASCENDING : self::SORT_DESCENDING;
-            $this->options['order'][] = [$column->getIndex(), $direction];
+        $direction = mb_strtolower($direction);
+        if (!in_array($direction, self::SORT_OPTIONS, true)) {
+            throw new \InvalidArgumentException(sprintf('Sort direction must be one of %s', implode(', ', self::SORT_OPTIONS)));
         }
+        $this->options['order'][] = [$column->getIndex(), $direction];
 
         return $this;
     }

src/DataTableState.php

@@ -181,10 +181,11 @@ public function setGlobalSearch(string $globalSearch): static
 
     public function addOrderBy(AbstractColumn $column, string $direction = DataTable::SORT_ASCENDING): static
     {
-        if (false !== $this->dataTable->getOption('ordering')) {
-            $direction = DataTable::SORT_ASCENDING === mb_strtolower($direction) ? DataTable::SORT_ASCENDING : DataTable::SORT_DESCENDING;
-            $this->orderBy[] = [$column, $direction];
+        $direction = mb_strtolower($direction);
+        if (!in_array($direction, DataTable::SORT_OPTIONS, true)) {
+            throw new \InvalidArgumentException(sprintf('Sort direction must be one of %s', implode(', ', DataTable::SORT_OPTIONS)));
         }
+        $this->orderBy[] = [$column, $direction];
 
         return $this;
     }

tests/Unit/DataTableTest.php

@@ -96,7 +96,7 @@ public function testDataTableState(): void
         $state->setGlobalSearch('foo');
         $state->setOrderBy([
             [$datatable->getColumn(0), 'asc'],
-            [$datatable->getColumn(1), 'desc0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z'], // intentional sql-injection test
+            [$datatable->getColumn(1), 'desc'],
         ]);
         $state->setColumnSearch($datatable->getColumn(0), 'bar');
 
@@ -105,7 +105,6 @@ public function testDataTableState(): void
         $this->assertSame('foo', $state->getGlobalSearch());
         $this->assertCount(2, $state->getOrderBy());
         foreach ($state->getOrderBy() as $order) {
-            // ensure sql-injection failed
             $this->assertContains($order[1], [DataTable::SORT_ASCENDING, DataTable::SORT_DESCENDING]);
         }
         $this->assertSame('bar', $state->getSearchColumns(onlySearchable: false)['foo']['search']);
@@ -146,19 +145,23 @@ public function testDataTableStateSearchColumns(): void
     /**
      * If ordering is false, ensure columns are not ordered.
      */
-    public function testDataTablesStateOrdering(): void
+    public function testSortDirectionValidation(): void
     {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('direction must be one of');
+
         $datatable = $this
-            ->createMockDataTable(['ordering' => false])
+            ->createMockDataTable()
             ->add('foo', TextColumn::class, ['searchable' => true])
-            ->add('bar', TextColumn::class, ['searchable' => false])
-            ->setMethod(Request::METHOD_GET)
         ;
-        $datatable->handleRequest(Request::create('/?_dt=' . $datatable->getName()));
-
-        $state = $datatable->getState();
-        $state->addOrderBy($datatable->getColumn(0), DataTable::SORT_DESCENDING);
-        $this->assertEmpty($state->getOrderBy());
+        $datatable->handleRequest(Request::create('/foo', Request::METHOD_POST, [
+            '_dt' => $datatable->getName(),
+            'draw' => 684,
+            'order' => [[
+                'column' => 0,
+                'dir' => 'foo',
+            ]],
+        ]));
     }
 
     public function testPostMethod(): void