fix(iot-hub): restrict installed-items list sort property to a server-side allow-list

Unvalidated sortProperty on GET /api/iot-hub/installedItems was passed straight into Spring Data's Sort.by, so a client could trigger a 500 PropertyReferenceException by naming an unknown entity field. Add ALLOWED_SORT_PROPERTIES on IotHubInstalledItemEntity (createdTime, itemName, itemType, version) and call validatePageLink in the service so the failure is a 400 with a clear message.

dao/src/main/java/org/thingsboard/server/dao/iot_hub/IotHubInstalledItemServiceImpl.java

@@ -23,12 +23,15 @@ import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.iot_hub.IotHubInstalledItem;
 import org.thingsboard.server.common.data.page.PageData;
 import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.dao.model.sql.IotHubInstalledItemEntity;
 
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 
+import static org.thingsboard.server.dao.service.Validator.validatePageLink;
+
 @Service
 @RequiredArgsConstructor
 @Slf4j
@@ -49,6 +52,7 @@ class IotHubInstalledItemServiceImpl implements IotHubInstalledItemService {
 
     @Override
     public PageData<IotHubInstalledItem> findByTenantId(TenantId tenantId, List<String> itemTypes, UUID itemId, PageLink pageLink) {
+        validatePageLink(pageLink, IotHubInstalledItemEntity.ALLOWED_SORT_PROPERTIES);
         return iotHubInstalledItemDao.findByTenantId(tenantId, itemTypes, itemId, pageLink);
     }
 

dao/src/main/java/org/thingsboard/server/dao/model/sql/IotHubInstalledItemEntity.java

@@ -31,7 +31,11 @@ import org.thingsboard.server.common.data.iot_hub.IotHubInstalledItemDescriptor;
 import org.thingsboard.server.dao.model.BaseSqlEntity;
 import org.thingsboard.server.dao.model.ModelConstants;
 
+import java.util.Collections;
+import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Objects;
+import java.util.Set;
 import java.util.UUID;
 
 @Getter
@@ -41,6 +45,10 @@ import java.util.UUID;
 @Table(name = ModelConstants.IOT_HUB_INSTALLED_ITEM_TABLE_NAME)
 public class IotHubInstalledItemEntity extends BaseSqlEntity<IotHubInstalledItem> {
 
+    public static final Set<String> ALLOWED_SORT_PROPERTIES = Collections.unmodifiableSet(
+            new LinkedHashSet<>(List.of("createdTime", "itemName", "itemType", "version"))
+    );
+
     @Column(name = ModelConstants.IOT_HUB_INSTALLED_ITEM_TENANT_ID_COLUMN, nullable = false, columnDefinition = "UUID")
     private UUID tenantId;