test(lexical-graph): add graph_utils boundary cases and Cypher escaping tests (#424)

lexical-graph/tests/unit/storage/graph/test_graph_utils.py

@@ -356,3 +356,37 @@ def test_empty_filters_list_or_condition_returns_empty_string(self):
         )
         result = parse_metadata_filters_recursive(filters)
         assert result == ''
+
+
+class TestEscapeCypherLabelBoundary:
+    """Boundary test cases for escape_cypher_label."""
+
+    def test_escape_cypher_label_empty_string(self):
+        result = escape_cypher_label("")
+        assert isinstance(result, str)
+
+    def test_escape_cypher_label_non_string_type_error(self):
+        with pytest.raises(TypeError):
+            escape_cypher_label(12345)  # type: ignore
+
+
+class TestParseMetadataFiltersRecursiveBoundary:
+    """Boundary and nested filter cases for parse_metadata_filters_recursive."""
+
+    def test_parse_metadata_filters_three_level_nesting(self):
+        nested_filter = {
+            "AND": [
+                {"category": {"eq": "finance"}},
+                {"OR": [{"status": {"eq": "active"}}, {"priority": {"gte": 5}}]},
+            ]
+        }
+        result = parse_metadata_filters_recursive(nested_filter)
+        assert result is not None
+
+
+class TestFormatterForTypeBoundary:
+    """Boundary test cases for formatter_for_type."""
+
+    def test_formatter_for_type_empty_string(self):
+        result = formatter_for_type("")
+        assert result is not None

lexical-graph/tests/unit/storage/graph/test_graph_utils_injection.py

@@ -66,3 +66,17 @@ def test_numeric_value_not_quoted(self):
         """A numeric value is emitted unquoted alongside a backtick-quoted key."""
         clause = _clause('count', 5, operator=FilterOperator.GT)
         assert "source.`count` > 5" in clause
+
+
+class TestValueEscapingBreakoutPayloads:
+    """Adversarial and breakout payload tests for Cypher value escaping."""
+
+    def test_escape_cypher_payload_breakout_backtick_quote(self):
+        payload = "` MATCH (n) DETACH DELETE n; //"
+        escaped = escape_cypher_label(payload)
+        assert "\`" in escaped or "``" in escaped or escaped != payload
+
+    def test_escape_cypher_payload_unicode_null_bytes(self):
+        payload = "label\x00_admin"
+        escaped = escape_cypher_label(payload)
+        assert "\x00" not in escaped or isinstance(escaped, str)