Ensure to find users by eq token

Author: ilgrosso

core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/repo/UserRepo.java

@@ -40,7 +40,7 @@ public interface UserRepo
     @Override
     Optional<String> findUsername(@Param("key") String key);
 
-    @Query("SELECT e FROM #{#entityName} e WHERE e.token LIKE :token")
+    @Query("SELECT e FROM #{#entityName} e WHERE e.token = :token")
     @Override
     Optional<? extends User> findByToken(@Param("token") String token);
 

core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/UserTest.java

@@ -90,6 +90,18 @@ public void findUsername() {
     @Test
     public void findByToken() {
         assertTrue(userDAO.findByToken("WRONG TOKEN").isEmpty());
+
+        User user = userDAO.findById("823074dc-d280-436d-a7dd-07399fae48ec").orElseThrow();
+        user.generateToken(32, 60);
+        user = userDAO.save(user);
+
+        String token = user.getToken();
+        assertEquals(user.getKey(), userDAO.findByToken(token).orElseThrow().getKey());
+
+        // wildcards must not be interpreted as such, or tokens could be guessed character by character
+        assertTrue(userDAO.findByToken(token.substring(0, token.length() - 1) + "%").isEmpty());
+        assertTrue(userDAO.findByToken("%").isEmpty());
+        assertTrue(userDAO.findByToken("_").isEmpty());
     }
 
     @Test

core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/inner/UserTest.java

@@ -90,6 +90,18 @@ public void findUsername() {
     @Test
     public void findByToken() {
         assertTrue(userDAO.findByToken("WRONG TOKEN").isEmpty());
+
+        User user = userDAO.findById("823074dc-d280-436d-a7dd-07399fae48ec").orElseThrow();
+        user.generateToken(32, 60);
+        user = userDAO.save(user);
+
+        String token = user.getToken();
+        assertEquals(user.getKey(), userDAO.findByToken(token).orElseThrow().getKey());
+
+        // wildcards must not be interpreted as such, or tokens could be guessed character by character
+        assertTrue(userDAO.findByToken(token.substring(0, token.length() - 1) + "%").isEmpty());
+        assertTrue(userDAO.findByToken("%").isEmpty());
+        assertTrue(userDAO.findByToken("_").isEmpty());
     }
 
     @Test