fix(security): DSAR — escape LIKE wildcards in subject parameter

`matchEntities()` interpolated raw user-supplied `$subject` into the
`%`-anchored ILIKE comparator. Bind-parameterised so no classic SQLi,
but `%` and `_` inside `$subject` were not escaped — `subject=%@%`
matched every email, `subject=_` matched every value. Combined with
the downstream `eraseObjectsForSubject()` chain (admin-gated
`vergetelheid`), this is a one-call wildcard PII erase well beyond
legitimate DSAR semantics. The `mode === 'exact'` branch had the same
bug.

Pass `$subject` through `IDBConnection::escapeLikeParameter()` once
before either branch builds its named parameter.

Refs: #1419 review (blocker 5) — discussion_r3187494433

Author: rubenvdlinde

lib/Service/DsarService.php

@@ -473,15 +473,24 @@ private function matchEntities(string $subject, ?string $type, string $mode): ar
                     $qb->expr()->isNotNull('r.object_id')
                 );
 
+            // SECURITY: escape LIKE wildcards in user-supplied subject before
+            // wrapping with `%`-anchors. Without this, an admin (the
+            // `vergetelheid` endpoint is admin-gated) could pass
+            // `subject=%@%` or `subject=_` to match every PII row in
+            // `openregister_entities.value` — combined with the downstream
+            // `eraseObjectsForSubject()` chain, that's a one-call wildcard
+            // erase well beyond legitimate DSAR semantics.
+            $escapedSubject = $this->db->escapeLikeParameter($subject);
+
             if ($mode === 'ilike') {
                 $qb->andWhere(
-                    $qb->expr()->iLike('e.value', $qb->createNamedParameter('%'.$subject.'%'))
+                    $qb->expr()->iLike('e.value', $qb->createNamedParameter('%'.$escapedSubject.'%'))
                 );
             }
 
             if ($mode !== 'ilike') {
                 $qb->andWhere(
-                    $qb->expr()->iLike('e.value', $qb->createNamedParameter($subject))
+                    $qb->expr()->iLike('e.value', $qb->createNamedParameter($escapedSubject))
                 );
             }