Ensuring to escape Neo4j property values for search

Author: ilgrosso

core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAnySearchDAO.java

@@ -132,7 +132,7 @@ protected static void appendPlainAttrCond(
 
     protected static String escapeIfString(final String value, final boolean isStr) {
         return isStr
-                ? new StringBuilder().append('"').append(value).append('"').toString()
+                ? new StringBuilder().append('"').append(AnyRepoExt.escapeForLikeRegex(value)).append('"').toString()
                 : value;
     }
 
@@ -648,7 +648,7 @@ protected AnyCondQuery getQuery(
             if (!SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) {
                 Realm realm = realmSearchDAO.findByFullPath(cond.getExpression()).
                         orElseThrow(() -> new IllegalArgumentException(
-                        "Invalid Realm full path: " + cond.getExpression()));
+                                "Invalid Realm full path: " + cond.getExpression()));
                 cond.setExpression(realm.getKey());
             }
 
@@ -842,7 +842,7 @@ protected void wrapQuery(
         Stream.concat(
                 queryInfo.fields().stream(),
                 orderBy.stream().filter(clause -> !"id".equals(clause.getProperty())
-                && anyUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
+                        && anyUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
                 distinct().forEach(field -> match.append(", n.").append(field).append(" AS ").append(field));
 
         // take plain schemas into account

core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jRealmSearchDAO.java

@@ -101,7 +101,7 @@ protected static void appendPlainAttrCond(
 
     protected static String escapeIfString(final String value, final boolean isStr) {
         return isStr
-                ? new StringBuilder().append('"').append(value).append('"').toString()
+                ? new StringBuilder().append('"').append(AnyRepoExt.escapeForLikeRegex(value)).append('"').toString()
                 : value;
     }
 
@@ -278,7 +278,7 @@ protected void wrapQuery(
         Stream.concat(
                 queryInfo.fields().stream(),
                 orderBy.stream().filter(clause -> !"id".equals(clause.getProperty())
-                && realmUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
+                        && realmUtils.getField(clause.getProperty()).isPresent()).map(Order::getProperty)).
                 distinct().forEach(field -> match.append(", n.").append(field).append(" AS ").append(field));
 
         // take plain schemas into account