Prevent SQL Injection about smart_listing

[sigra]

I faced with the same problem and found a decision that works for me.

So, when you use sort_attributes option then library will use only that attributes and skip bad one. I don't know why this is not said in the official documentation.

Example:

sort_aliases = [
  [:id, "users.id"],
  [:email, "users.email"],
  [:name, "users.metadata->>'name'"] # you can sort JSONB too
]
@users = smart_listing_create(:users, User, sort_attributes: sort_aliases)

# view part
<th><%= smart_listing.sortable 'ID', :id %></th>
<th><%= smart_listing.sortable 'Name', :name %></th>

So, when I change params for "sort"=>{"id;TRUNCATE users;--"=>"asc"}} it just ignored and nothing will happen.

[korun]

Fixed in 0794ed4 (v1.2.3), but it can cause some issues on update for some complicated queries with sort on joined tables (see #158 for more)