Ensuring opEvent parameter in AuditEvent queries

Author: ilgrosso

core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAuditEventDAO.java

@@ -97,12 +97,14 @@ public AuditEventCriteriaBuilder opEvent(
                 final String category,
                 final String subcategory,
                 final String op,
-                final OpEvent.Outcome outcome) {
+                final OpEvent.Outcome outcome,
+                final List<Object> parameters) {
 
             query.append(andIfNeeded()).
-                    append("opEvent LIKE '").
-                    append(toOpEvent(type, category, subcategory, op, outcome).replace("[]", "[%]")).
-                    append("'");
+                    append("opEvent LIKE ?").append(setParameter(
+                    parameters,
+                    toOpEvent(type, category, subcategory, op, outcome).replace("[]", "[%]"))).
+                    append(" ESCAPE '#'");
 
             return this;
         }
@@ -174,7 +176,7 @@ public long count(
                 + " WHERE" + criteriaBuilder(entityKey).
                         username(username, parameters).
                         who(who, parameters).
-                        opEvent(type, category, subcategory, op, outcome).
+                        opEvent(type, category, subcategory, op, outcome, parameters).
                         before(before, parameters).
                         after(after, parameters).
                         build();
@@ -205,7 +207,7 @@ public List<AuditEventTO> search(
                 + " WHERE" + criteriaBuilder(entityKey).
                         username(username, parameters).
                         who(who, parameters).
-                        opEvent(type, category, subcategory, op, outcome).
+                        opEvent(type, category, subcategory, op, outcome, parameters).
                         before(before, parameters).
                         after(after, parameters).
                         build();

core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jAuditEventDAO.java

@@ -87,13 +87,12 @@ public AuditEventCriteriaBuilder opEvent(
                 final String category,
                 final String subcategory,
                 final String op,
-                final OpEvent.Outcome outcome) {
+                final OpEvent.Outcome outcome,
+                final Map<String, Object> parameters) {
 
-            query.append(andIfNeeded()).
-                    append("n.opEvent =~ '").
-                    append(toOpEvent(type, category, subcategory, op, outcome).
-                            replace("[", "\\[").replace("]", "\\]").replace("\\[\\]", "\\[.*\\]")).
-                    append("'");
+            parameters.put("opEvent", toOpEvent(type, category, subcategory, op, outcome).
+                    replace("[", "\\[").replace("]", "\\]").replace("\\[\\]", "\\[.*\\]"));
+            query.append(andIfNeeded()).append("n.opEvent =~ $opEvent");
 
             return this;
         }
@@ -164,7 +163,7 @@ public long count(
                 + " WHERE " + criteriaBuilder(entityKey).
                         username(username, parameters).
                         who(who, parameters).
-                        opEvent(type, category, subcategory, op, outcome).
+                        opEvent(type, category, subcategory, op, outcome, parameters).
                         before(before, parameters).
                         after(after, parameters).
                         build()
@@ -193,7 +192,7 @@ public List<AuditEventTO> search(
                 + "WHERE " + criteriaBuilder(entityKey).
                         username(username, parameters).
                         who(who, parameters).
-                        opEvent(type, category, subcategory, op, outcome).
+                        opEvent(type, category, subcategory, op, outcome, parameters).
                         before(before, parameters).
                         after(after, parameters).
                         build()