Team Calendars erroneously sends out notification emails to users not watching it

Problem Summary

Sometimes watchers of a page containing an embedded calendar will receive notifications if a completely different calendar has been updated

Details

When a user updates a calendar (i.e. adds a new event), it seems that Team Calendars will look for pages (via Lucene index) that have the calendar embedded by searching for the calendarId. Watchers of all these pages will then receive a notification email from Team Calendars.

The problem is that the calendarId search is not accurate. Consider the following Confluence search:

embeddedSubCalendarId:83ded06a-f3ce-4639-a431-a807c9926fc9

Instead of searching for that entire unbroken string, it seems that Lucene is breaking this into smaller pieces, delimitated by the hyphen. This can be demonstrated by trial-and-error or via an utility like Luke to examine the index:

As a result, pages that embed completely different calendars that happen to match any of the pieces will come back in the search, and watchers of those pages will receive an unintended notification.

Steps to reproduce

I tested this with Confluence 5.4.1 + Team Calendars 4.1.4

1. Create 2 calendars, Calendar A and Calendar B, and make note of their calendarId values (Grab it from Down arrow > Share/embed)
2. Create a page and embed Calendar A onto it. Make note of the pageId (Edit the page and grab it from the URL)
3. Add a user who is not watching any of the calendars as a Watcher of this page
4. In the database, locate those page contents in the BODYCONTENT table, and replace part of the Id of Calendar A with a part of Calendar B. The result will be an invalid calendarId, but that's fine for the purposes of this test. I used MySQL to test, your query may vary:

   UPDATE BODYCONTENT
   SET body = REPLACE(body, '<part_of_calendar_a>', '<part_of_calendar_b>')
   WHERE contentid = '<pageId>';
   

5. Rebuild index (Confluence Admin > Content Indexing)
6. Add an event to Calendar B

Expected result

Page watcher in step 3 will not receive a notification

Actual result

Page watcher in step 3 receives notification, because the test page contains part of the Id of Calendar B.