(syncope) branch 4_1_X updated: Ensuring to escape Neo4j property values for search

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_1_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_1_X by this push:
     new 18c08d3e58 Ensuring to escape Neo4j property values for search
18c08d3e58 is described below

commit 18c08d3e58383c3281582145d6b05efdc1a00eac
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Sep 7 15:34:02 2026 +0200

    Ensuring to escape Neo4j property values for search
---
 .../syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java       | 6 +++---
 .../syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
index a433c9fb2e..992a06d148 100644
--- 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
+++ 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
@@ -122,7 +122,7 @@ public class Neo4jAnySearchDAO extends AbstractAnySearchDAO 
{
 
     protected static String escapeIfString(final String value, final boolean 
isStr) {
         return isStr
-                ? new 
StringBuilder().append('"').append(value).append('"').toString()
+                ? new 
StringBuilder().append('"').append(AnyRepoExt.escapeForLikeRegex(value)).append('"').toString()
                 : value;
     }
 
@@ -575,7 +575,7 @@ public class Neo4jAnySearchDAO extends AbstractAnySearchDAO 
{
             if 
(!SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) {
                 Realm realm = 
realmSearchDAO.findByFullPath(cond.getExpression()).
                         orElseThrow(() -> new IllegalArgumentException(
-                        "Invalid Realm full path: " + cond.getExpression()));
+                                "Invalid Realm full path: " + 
cond.getExpression()));
                 cond.setExpression(realm.getKey());
             }
 
@@ -766,7 +766,7 @@ public class Neo4jAnySearchDAO extends AbstractAnySearchDAO 
{
         Stream.concat(
                 queryInfo.fields().stream(),
                 orderBy.stream().filter(clause -> 
!"id".equals(clause.getProperty())
-                && 
anyUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
+                        && 
anyUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
                 distinct().forEach(field -> match.append(", 
n.").append(field).append(" AS ").append(field));
 
         // take plain schemas into account
diff --git 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
index 7fc1dccfd0..d4bf3ceb59 100644
--- 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
+++ 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
@@ -103,7 +103,7 @@ public class Neo4jRealmSearchDAO extends 
AbstractRealmSearchDAO {
 
     protected static String escapeIfString(final String value, final boolean 
isStr) {
         return isStr
-                ? new 
StringBuilder().append('"').append(value).append('"').toString()
+                ? new 
StringBuilder().append('"').append(AnyRepoExt.escapeForLikeRegex(value)).append('"').toString()
                 : value;
     }
 
@@ -282,7 +282,7 @@ public class Neo4jRealmSearchDAO extends 
AbstractRealmSearchDAO {
         Stream.concat(
                 queryInfo.fields().stream(),
                 orderBy.stream().filter(clause -> 
!"id".equals(clause.getProperty())
-                && 
realmUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
+                        && 
realmUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
                 distinct().forEach(field -> match.append(", 
n.").append(field).append(" AS ").append(field));
 
         // take plain schemas into account