test(backend): cover malformed remediation payload guardrails (#2157)

[Srv99x]

Summary

Closes #2157.

Adds a focused regression test suite that exercises every public entry point in
backend/secuscan/remediation.py against malformed and structurally broken
inputs. The tests verify that the safety layer always returns a controlled,
predictable result — never an unhandled exception.

---

What changed

testing/backend/unit/test_remediation_malformed_payload.py (new)

• 8 test classes, 82 parametrized cases across all helpers and the full pipeline

backend/secuscan/remediation.py (patched)

Four defensive guardrails added (real bugs exposed by the tests):

Location	Bug	Fix
parse_remediation_suggestion	TypeError on non-string input	isinstance guard → returns None
validate_remediation	KeyError: 'specifier' on bad graph entry	Filter constraints to valid dicts only
parse_package_lock	AttributeError when JSON root is a list	if not isinstance(data, dict): return {}
parse_package_lock	AttributeError when packages is a string	if not isinstance(packages, dict): packages = {}

---

Acceptance criteria

• Regression case is reproducible in an automated test
• Expected safe behaviour is asserted explicitly (_assert_controlled_result helper)
• Existing behaviour remains covered — all 12 existing test_remediation_safety.py tests still pass
• Focused test passes locally — 94/94 tests pass

---

Test run

$ python -m pytest testing/backend/unit/test_remediation_malformed_payload.py \
                   testing/backend/unit/test_remediation_safety.py \
                   -v --noconftest

...
testing/backend/unit/test_remediation_malformed_payload.py::TestEndToEndMalformedPayload::test_remediation_with_only_special_chars PASSED [ 81%]
testing/backend/unit/test_remediation_malformed_payload.py::TestEndToEndMalformedPayload::test_remediation_with_unicode_noise PASSED [ 82%]
testing/backend/unit/test_remediation_malformed_payload.py::TestEndToEndMalformedPayload::test_remediation_with_valid_string_but_unknown_package PASSED [ 84%]
testing/backend/unit/test_remediation_malformed_payload.py::TestEndToEndMalformedPayload::test_remediation_conflict_produces_actionable_alternatives PASSED [ 85%]
testing/backend/unit/test_remediation_malformed_payload.py::TestEndToEndMalformedPayload::test_safe_upgrade_within_constraint_window PASSED [ 86%]
testing/backend/unit/test_remediation_malformed_payload.py::TestEndToEndMalformedPayload::test_result_is_always_deterministic PASSED [ 87%]
testing/backend/unit/test_remediation_safety.py::test_normalize_package_name PASSED [ 88%]
testing/backend/unit/test_remediation_safety.py::test_clean_version_string PASSED [ 89%]
testing/backend/unit/test_remediation_safety.py::test_parse_remediation_suggestion PASSED [ 90%]
testing/backend/unit/test_remediation_safety.py::test_semver_to_pep440 PASSED [ 91%]
testing/backend/unit/test_remediation_safety.py::test_parse_requirement_line PASSED [ 92%]
testing/backend/unit/test_remediation_safety.py::test_parse_package_lock PASSED [ 93%]
testing/backend/unit/test_remediation_safety.py::test_parse_package_json PASSED [ 94%]
testing/backend/unit/test_remediation_safety.py::test_validate_remediation_no_conflict PASSED [ 95%]
testing/backend/unit/test_remediation_safety.py::test_validate_remediation_with_conflict PASSED [ 96%]
testing/backend/unit/test_remediation_safety.py::test_finding_model_safety_fields PASSED [ 97%]
testing/backend/unit/test_remediation_safety.py::test_build_dependency_graph_fallback_disabled PASSED [ 98%]
testing/backend/unit/test_remediation_safety.py::test_build_dependency_graph_python_transitive_mocked PASSED [100%]

============================= 94 passed in 1.08s ==============================

---

🤖 AI Disclosure

This pull request was developed with the assistance of Antigravity (Google DeepMind), an AI coding assistant.

The AI was used to:

• Analyse remediation.py and the existing test file to map the full API surface
• Design and write the regression test suite (test_remediation_malformed_payload.py)
• Identify four latent bugs in remediation.py from test failures and apply minimal defensive patches
• Run black and isort formatting on both modified files

All code was reviewed, verified correct, and confirmed passing locally before this PR was opened.

[Srv99x]

@utksh1 The frontend-run-checks failure is unrelated to this PR.

This PR only modifies backend Python files:

• backend/secuscan/remediation.py
• testing/backend/unit/test_remediation_malformed_payload.py

The failure is caused by a pre-existing high-severity npm vulnerability in undici
(GHSA-4cwx-7wf7-3272, CVSS 7.4) in the frontend dependencies, which blocks the
npm audit CI gate. All backend checks pass green. ✅

[utksh1]

Good defensive guards for malformed remediation payloads. Test coverage looks solid. Backend-only change; frontend failures unrelated.