Allow sorting by named expression

[pbyrne]

Assorted currently only allows sorting by a column on the table, or else it raises an ActiveRecord::StatementInvalid exception. It would be nice to be able to sort by named expression e.g., Foo.select("id, lower(bar) as lower_bar").asc("lower_bar").

[frogandcode]

Any reason not to simply remove the attribute names check here?

assorted/lib/assorted/scopes.rb

Line 18 in 29c9e43

if attribute_names.include?(column.to_s)

COUNT(*) and AS are commonly used in SELECT statements. Doesn't seem to buy us much given that the query will blow up if it's wrong, validation or no.

[pbyrne]

The check against attribute names was to prevent SQL injection from user input, to only allow known-good columns to sort by. There are almost certainly better ways to achieve this safety while still allowing sorting by count(*) or named expressions, but I'm not quite sure what they are yet.

[pbyrne]

Hell, maybe just ensuring that the given sort parameter is escaped might do the trick. But that would probably prevent sorting by count(*).

[frogandcode]

Seems like the onus for managing SQL injection should be with Active Record and the developer using it. If order doesn't sanitize it's parameters, I'm not sure why assorted should - it's just a convenience for calling order.