Fix merging relation that order including `?`

The `Relation::Merger` has a problem that order values would be merged
as nested array.

That was caused an issue #33664 since if array value is passed to
`order` and first element in the array includes `?`, the array is
regarded as a prepared statement and bind variables.

https://api.rubyonrails.org/classes/ActiveRecord/Sanitization/ClassMethods.html#method-i-sanitize_sql_for_order

Just merging that as splat args like other values would fix the issue.

Fixes #33664.

1 files changed, 10 insertions, 0 deletions

diff --git a/activerecord/test/cases/relation/merging_test.rb b/activerecord/test/cases/relation/merging_test.rb
index f53ef1fe35..6e7998d15a 100644
--- a/activerecord/test/cases/relation/merging_test.rb
+++ b/activerecord/test/cases/relation/merging_test.rb
@@ -121,6 +121,16 @@ class RelationMergingTest < ActiveRecord::TestCase
     relation = relation.merge(Post.from("posts"))
     assert_not_empty relation.from_clause
   end
+
+  def test_merging_with_order_with_binds
+    relation = Post.all.merge(Post.order([Arel.sql("title LIKE ?"), "%suffix"]))
+    assert_equal ["title LIKE '%suffix'"], relation.order_values
+  end
+
+  def test_merging_with_order_without_binds
+    relation = Post.all.merge(Post.order(Arel.sql("title LIKE '%?'")))
+    assert_equal ["title LIKE '%?'"], relation.order_values
+  end
 end
 
 class MergingDifferentRelationsTest < ActiveRecord::TestCase