I think the whitelist is the only good solution we have at this point. We can easily detect sort fields for the Table being actively sorted. We cannot look at the query fields as default fields for queries do not materialize until the Query is transformed into SQL, which is way after the sort conditions need to be validated and applied.

The only possible option I can see for allowing automatic sorting on associated columns is to introspect the contained associations, like you pasted earlier. Is that something we're comfortable having?