{"record":{"id":"c8ffa8295016c55b","repo":"instructure/canvas-lms","slug":"sort-by-field-field-is-not-supported","errorCode":null,"errorMessage":"Sort by field '#{field}' is not supported","messagePattern":"Sort by field '#(.+?)' is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/graphql/types/assignment_type.rb","lineNumber":931,"sourceCode":"          end\n        end\n      end\n    end\n\n    field :assignment_target_connection, AssignmentOverrideType.connection_type, null: true do\n      argument :order_by, AssignmentTargetSortOrderInputType, required: false\n    end\n    def assignment_target_connection(order_by: nil)\n      load_association(:context).then do |context|\n        return unless context.grants_any_right?(current_user, *RoleOverride::GRANULAR_MANAGE_ASSIGNMENT_PERMISSIONS)\n\n        scope = assignment.all_assignment_overrides.active\n\n        if order_by.present?\n          field = order_by[:field]\n          direction = (order_by[:direction] == \"descending\") ? \"DESC NULLS LAST\" : \"ASC\"\n\n          raise \"Sort by field '#{field}' is not supported\" unless %w[title due_at lock_at unlock_at].include?(field)\n\n          scope = scope.order(Arel.sql(\"assignment_overrides.#{field} #{direction}\"))\n        end\n\n        scope\n      end\n    end\n\n    field :anonymous_student_identities, [AnonymousStudentIdentityType], null: true\n    def anonymous_student_identities\n      return nil unless assignment.context.grants_right?(current_user, :manage_grades)\n\n      assignment.anonymous_student_identities.values\n    end\n\n    field :auto_grade_assignment_issues, Types::EligibilityIssueType, null: true, description: \"Issues related to the assignment\", deprecation_reason: \"Use autoGradeEligibility instead\"\n    def auto_grade_assignment_issues\n      load_association(:context).then do |course|","sourceCodeStart":913,"sourceCodeEnd":949,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/types/assignment_type.rb#L913-L949","documentation":"AssignmentType#assignment_target_connection orders assignment overrides by a whitelisted set of fields (title, due_at, lock_at, unlock_at); any other order_by[:field] raises this error before being interpolated into SQL. It protects against arbitrary ORDER BY injection.","triggerScenarios":"A GraphQL query on assignment assignmentOverrides/connection with orderBy field set to something other than title, due_at, lock_at, or unlock_at (e.g. 'id', 'dueAt' camelCase, 'created_at').","commonSituations":"Clients sending camelCase GraphQL field names instead of the SQL-style column names the backend expects; UI added a new sort column before backend whitelist updated.","solutions":["Use one of the supported field values: title, due_at, lock_at, unlock_at","Normalize the client's sort keys to snake_case before sending","Extend the whitelist in assignment_type.rb if a new sort field is legitimately needed (with proper column validation)"],"exampleFix":"// before\norderBy: { field: \"dueAt\", direction: \"ascending\" }\n// after\norderBy: { field: \"due_at\", direction: \"ascending\" }","handlingStrategy":"validation","validationCode":"const SUPPORTED_SORT_FIELDS = ['title', 'due_at', 'lock_at', 'unlock_at'];\nif (orderBy?.field && !SUPPORTED_SORT_FIELDS.includes(orderBy.field)) {\n  throw new Error(`Sort field must be one of ${SUPPORTED_SORT_FIELDS.join(', ')}`);\n}","typeGuard":"function isSupportedSortField(f) {\n  return ['title', 'due_at', 'lock_at', 'unlock_at'].includes(f);\n}","tryCatchPattern":"try {\n  await fetchAssignmentOverrides(query, orderBy);\n} catch (e) {\n  if (/Sort by field .* is not supported/.test(e.message)) {\n    showError('Unsupported sort field; use title, due_at, lock_at, or unlock_at.');\n  }\n}","preventionTips":["Centralize the whitelist of sortable fields and import it in clients","Convert camelCase GraphQL names to snake_case column names in one adapter layer","Add tests asserting each supported sort value passes","Never interpolate user-supplied ORDER BY columns without whitelist checks"],"tags":["graphql","sorting","assignments"],"backgroundTag":"invalid-argument-value","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}