CVE-2016-3072

@@ -57,8 +57,9 @@ def scoped_search(query, default_sort_by, default_sort_order, options = {})
       sort_attr = params[:sort_by] || default_sort_by
 
       if sort_attr
-        sort_attr = "#{query.table_name}.#{sort_attr}" unless sort_attr.to_s.include?('.')
-        query = query.order("#{sort_attr} #{params[:sort_order] || default_sort_order}")
+        sort_order = (params[:sort_order] || default_sort_order).to_s.downcase
+        sort_order = default_sort_order unless ['desc', 'asc'].include?(sort_order)
+        query = query.order(sort_attr => sort_order.to_sym)
       elsif options[:custom_sort]
         query = options[:custom_sort].call(query)
       end

@@ -20,9 +20,11 @@ class Api::V2::ContentViewVersionsController < Api::V2::ApiController
     param :composite_version_id, :identifier, :desc => N_("Filter versions that are components in the specified composite version"), :required => false
     param_group :search, Api::V2::ApiController
     def index
-      includes = [:content_view, :environments, :composite_content_views, :history => :task]
-      sort = "#{ContentViewVersion.table_name}.major desc, #{ContentViewVersion.table_name}.minor desc"
-      respond(:collection => scoped_search(index_relation.uniq, sort, '', :includes => includes))
+      options = {
+        :includes => [:content_view, :environments, :composite_content_views, :history => :task],
+        :custom_sort => lambda { |query| query.order("#{ContentViewVersion.table_name}.major desc, #{ContentViewVersion.table_name}.minor desc") }
+      }
+      respond(:collection => scoped_search(index_relation.uniq, nil, nil, options))
     end
 
     def index_relation

@@ -1,13 +1,15 @@
-require 'katello_test_helper'
+# encoding: utf-8
+
+require "katello_test_helper"
 
 module Katello
   class Api::V2::ApiControllerTest < ActionController::TestCase
     def setup
-      katello_errata
       @controller = Katello::Api::V2::ApiController.new
       @query = Erratum.all
       @default_sort = %w(updated desc)
       @options = { :resource_class => Katello::Erratum }
+      @errata = katello_errata
     end
 
     def teardown
@@ -51,5 +53,16 @@ def test_scoped_search_zero_total
       assert_equal 0, response[:total], "total"
       assert_nil response[:error], "error"
     end
+
+    def test_scoped_search_order
+      params = {:sort_by => "errata_id", :sort_order => "DESC'"} # sql injection
+      @controller.stubs(:params).returns(params)
+
+      query = Erratum.all
+      options = {resource_class: Katello::Erratum}
+
+      results = @controller.scoped_search(query, "errata_id", "asc", options)[:results]
+      assert_equal ["RHBA-2014-013", "RHEA-2014-111", "RHSA-1999-1231"], results.map(&:errata_id)
+    end
   end
 end