(syncope) branch 4_0_X updated: Ensuring to escape Neo4j property values for search

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch 4_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/4_0_X by this push:
     new ed50f0c68b Ensuring to escape Neo4j property values for search
ed50f0c68b is described below

commit ed50f0c68b1d919aca5e0229e69ff0a60a6ea8c1
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Sep 7 15:34:02 2026 +0200

    Ensuring to escape Neo4j property values for search
---
 .../syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java       | 6 +++---
 .../syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
index f2f66bf428..27a61efff9 100644
--- 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
+++ 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java
@@ -132,7 +132,7 @@ public class Neo4jAnySearchDAO extends AbstractAnySearchDAO 
{
 
     protected static String escapeIfString(final String value, final boolean 
isStr) {
         return isStr
-                ? new 
StringBuilder().append('"').append(value).append('"').toString()
+                ? new 
StringBuilder().append('"').append(AnyRepoExt.escapeForLikeRegex(value)).append('"').toString()
                 : value;
     }
 
@@ -648,7 +648,7 @@ public class Neo4jAnySearchDAO extends AbstractAnySearchDAO 
{
             if 
(!SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) {
                 Realm realm = 
realmSearchDAO.findByFullPath(cond.getExpression()).
                         orElseThrow(() -> new IllegalArgumentException(
-                        "Invalid Realm full path: " + cond.getExpression()));
+                                "Invalid Realm full path: " + 
cond.getExpression()));
                 cond.setExpression(realm.getKey());
             }
 
@@ -842,7 +842,7 @@ public class Neo4jAnySearchDAO extends AbstractAnySearchDAO 
{
         Stream.concat(
                 queryInfo.fields().stream(),
                 orderBy.stream().filter(clause -> 
!"id".equals(clause.getProperty())
-                && 
anyUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
+                        && 
anyUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
                 distinct().forEach(field -> match.append(", 
n.").append(field).append(" AS ").append(field));
 
         // take plain schemas into account
diff --git 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
index 53aad9b1c7..f4ba8c37c5 100644
--- 
a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
+++ 
b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java
@@ -101,7 +101,7 @@ public class Neo4jRealmSearchDAO extends 
AbstractRealmSearchDAO {
 
     protected static String escapeIfString(final String value, final boolean 
isStr) {
         return isStr
-                ? new 
StringBuilder().append('"').append(value).append('"').toString()
+                ? new 
StringBuilder().append('"').append(AnyRepoExt.escapeForLikeRegex(value)).append('"').toString()
                 : value;
     }
 
@@ -278,7 +278,7 @@ public class Neo4jRealmSearchDAO extends 
AbstractRealmSearchDAO {
         Stream.concat(
                 queryInfo.fields().stream(),
                 orderBy.stream().filter(clause -> 
!"id".equals(clause.getProperty())
-                && 
realmUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
+                        && 
realmUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
                 distinct().forEach(field -> match.append(", 
n.").append(field).append(" AS ").append(field));
 
         // take plain schemas into account