push order arg checks down to allow for binds

1 files changed, 5 insertions, 1 deletions

diff --git a/activerecord/lib/active_record/sanitization.rb b/activerecord/lib/active_record/sanitization.rb
index 4caf1145f0..232743d3b6 100644
--- a/activerecord/lib/active_record/sanitization.rb
+++ b/activerecord/lib/active_record/sanitization.rb
@@ -63,13 +63,17 @@ module ActiveRecord
         #   # => "id ASC"
         def sanitize_sql_for_order(condition) # :doc:
           if condition.is_a?(Array) && condition.first.to_s.include?("?")
+            enforce_raw_sql_whitelist([condition.first],
+              whitelist: AttributeMethods::ClassMethods::COLUMN_NAME_ORDER_WHITELIST
+            )
+
             # Ensure we aren't dealing with a subclass of String that might
             # override methods we use (eg. Arel::Nodes::SqlLiteral).
             if condition.first.kind_of?(String) && !condition.first.instance_of?(String)
               condition = [String.new(condition.first), *condition[1..-1]]
             end
 
-            sanitize_sql_array(condition)
+            Arel.sql(sanitize_sql_array(condition))
           else
             condition
           end