Ensure that already escaped identifiers that are stored in the Database

will not be escaped again on loading, adjusted test to contain some of
the original offenders

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/TypeRelativeObjectIdentifier.java

@@ -11,6 +11,13 @@ public class TypeRelativeObjectIdentifier implements Serializable {
 
     public TypeRelativeObjectIdentifier() {}
 
+    /**
+     * Only for DB restore, as the identifier is already escaped and would be double escaped
+     */
+    TypeRelativeObjectIdentifier(String rawIdentifier) {
+        typeRelativeIdentifer = rawIdentifier;
+    }
+
     public TypeRelativeObjectIdentifier(String... identifers) {
         typeRelativeIdentifer = WildcardPermissionEncoder.encode(identifers);
     }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/QualifiedObjectIdentifierImpl.java

@@ -11,20 +11,14 @@ public class QualifiedObjectIdentifierImpl implements QualifiedObjectIdentifier
     private final String typeIdentifier;
     private final TypeRelativeObjectIdentifier typeRelativeObjectIdentifier;
     
-    /**
-     * Parses the output of {@link QualifiedObjectIdentifier#toString()} into an instance of this class.
-     * 
-     * @param qualifiedObjectIdentifierAsString
-     *            expected to contain {@link QualifiedObjectIdentifier#QUALIFIER_SEPARATOR}; an
-     *            {@link IllegalArgumentException will result otherwise.
-     */
-    public QualifiedObjectIdentifierImpl(String qualifiedObjectIdentifierAsString) {
+    private QualifiedObjectIdentifierImpl(String qualifiedObjectIdentifierAsString) {
         final int indexOfSeparator = qualifiedObjectIdentifierAsString.indexOf(QUALIFIER_SEPARATOR);
         if (indexOfSeparator < 0) {
             throw new IllegalArgumentException("Qualified object identifier must contain separator character "+QUALIFIER_SEPARATOR);
         }
         typeIdentifier = qualifiedObjectIdentifierAsString.substring(0, indexOfSeparator);
-        typeRelativeObjectIdentifier = new TypeRelativeObjectIdentifier(qualifiedObjectIdentifierAsString.substring(indexOfSeparator+1));
+        String typeRelativeIdentifier = qualifiedObjectIdentifierAsString.substring(indexOfSeparator + 1);
+        typeRelativeObjectIdentifier = new TypeRelativeObjectIdentifier(typeRelativeIdentifier);
     }
 
     public QualifiedObjectIdentifierImpl(String typeIdentifier, TypeRelativeObjectIdentifier typeRelativeObjectIdentifier) {
@@ -33,6 +27,16 @@ public class QualifiedObjectIdentifierImpl implements QualifiedObjectIdentifier
         this.typeRelativeObjectIdentifier = typeRelativeObjectIdentifier;
     }
 
+    /**
+     * This should only be used from the db, as the TypeRelativeIdentifier is not escaped
+     * 
+     * @param rawId
+     * @return
+     */
+    public static QualifiedObjectIdentifier fromDBWithoutEscaping(String rawId) {
+        return new QualifiedObjectIdentifierImpl(rawId);
+    }
+
     @Override
     public String getTypeIdentifier() {
         return typeIdentifier;

java/com.sap.sse.security.test/src/com/sap/sse/security/test/HasPermissionsTest.java

@@ -16,13 +16,13 @@ import com.sap.sse.security.shared.impl.WildcardPermissionEncoder;
 
 public class HasPermissionsTest {
 
-    private final static String OBJECT_NAME = " Regatta :2018 ";
+    private final static String OBJECT_NAME = " Regatta :2018///\"@::";
     private final static String OBJECT_NAME_ENCODED = WildcardPermissionEncoder.encode(OBJECT_NAME);
     private final static Action READ_ACTION = HasPermissions.DefaultActions.READ;
 
     @Test
     public void getQualifiedObjectIdentifierFromTypedObjectIdentifer() {
-        final QualifiedObjectIdentifier q = new QualifiedObjectIdentifierImpl("type/" + OBJECT_NAME);
+        final QualifiedObjectIdentifier q = QualifiedObjectIdentifierImpl.fromDBWithoutEscaping("type/" + OBJECT_NAME);
         final HasPermissions h = new HasPermissionsImpl("type");
         final TypeRelativeObjectIdentifier t = new TypeRelativeObjectIdentifier(OBJECT_NAME);
         assertEquals(q, h.getQualifiedObjectIdentifier(t));

java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/impl/DomainObjectFactoryImpl.java

@@ -70,7 +70,8 @@ public class DomainObjectFactoryImpl implements DomainObjectFactory {
     
     @SuppressWarnings("unchecked")
     private AccessControlListAnnotation loadAccessControlList(Document aclDBObject, UserStore userStore) {
-        final QualifiedObjectIdentifier id = new QualifiedObjectIdentifierImpl((String) aclDBObject.get(FieldNames.AccessControlList.OBJECT_ID.name()));
+        final QualifiedObjectIdentifier id = QualifiedObjectIdentifierImpl
+                .fromDBWithoutEscaping((String) aclDBObject.get(FieldNames.AccessControlList.OBJECT_ID.name()));
         final String displayName = (String) aclDBObject.get(FieldNames.AccessControlList.OBJECT_DISPLAY_NAME.name());
         List<Object> dbPermissionMap = ((List<Object>) aclDBObject.get(FieldNames.AccessControlList.PERMISSION_MAP.name()));
         Map<UserGroup, Set<String>> permissionMap = new HashMap<>();
@@ -105,7 +106,8 @@ public class DomainObjectFactoryImpl implements DomainObjectFactory {
     }
     
     private OwnershipAnnotation loadOwnership(Document ownershipDBObject, UserStore userStore) {
-        final QualifiedObjectIdentifier idOfOwnedObject = new QualifiedObjectIdentifierImpl((String) ownershipDBObject.get(FieldNames.Ownership.OBJECT_ID.name()));
+        String rawId = (String) ownershipDBObject.get(FieldNames.Ownership.OBJECT_ID.name());
+        final QualifiedObjectIdentifier idOfOwnedObject = QualifiedObjectIdentifierImpl.fromDBWithoutEscaping(rawId);
         final String displayNameOfOwnedObject = (String) ownershipDBObject.get(FieldNames.Ownership.OBJECT_DISPLAY_NAME.name());
         final String userOwnerName = (String) ownershipDBObject.get(FieldNames.Ownership.OWNER_USERNAME.name());
         final UUID tenantOwnerId = (UUID) ownershipDBObject.get(FieldNames.Ownership.TENANT_OWNER_ID.name());