fix(neptune): escape filter values in openCypher queries to prevent injection (#5982)

Signed-off-by: Hrushikesh Yadav <yadavhrushikesh65@gmail.com>

tests/vector_stores/test_neptune_analytics.py

@@ -6,6 +6,11 @@ import pytest
 from dotenv import load_dotenv
 
 from mem0.utils.factory import VectorStoreFactory
+from mem0.vector_stores.neptune_analytics import (
+    NeptuneAnalyticsVector,
+    _escape_cypher,
+    _validate_filter,
+)
 
 load_dotenv()
 
@@ -184,3 +189,51 @@ class TestNeptuneAnalyticsOperations:
 
         with pytest.raises(ValueError):
             VectorStoreFactory.create("neptune", config)
+
+
+class TestNeptuneFilterValidation:
+    def test_filter_rejects_dict_value(self):
+        with pytest.raises(ValueError):
+            _validate_filter("user_id", {"$ne": ""})
+
+    def test_filter_rejects_list_value(self):
+        with pytest.raises(ValueError):
+            _validate_filter("user_id", ["alice"])
+
+    def test_filter_rejects_invalid_key(self):
+        with pytest.raises(ValueError):
+            _validate_filter("user_id'; DROP", "alice")
+
+    def test_filter_accepts_scalars(self):
+        _validate_filter("user_id", "alice")
+        _validate_filter("count", 42)
+        _validate_filter("label", "MEM0_VECTOR_test")
+
+    def test_escape_cypher_quotes(self):
+        assert _escape_cypher("alice") == "alice"
+        assert _escape_cypher("it's") == "it\\'s"
+        assert _escape_cypher("a\\b") == "a\\\\b"
+
+    def test_where_clause_escapes_values(self):
+        clause = NeptuneAnalyticsVector._get_where_clause(
+            {"user_id": "it's a test"}
+        )
+        assert "it\\'s a test" in clause
+
+    def test_where_clause_rejects_dict(self):
+        with pytest.raises(ValueError):
+            NeptuneAnalyticsVector._get_where_clause(
+                {"user_id": {"$ne": ""}}
+            )
+
+    def test_node_filter_escapes_values(self):
+        clause = NeptuneAnalyticsVector._get_node_filter_clause(
+            {"label": "it's"}
+        )
+        assert "it\\'s" in clause
+
+    def test_node_filter_rejects_dict(self):
+        with pytest.raises(ValueError):
+            NeptuneAnalyticsVector._get_node_filter_clause(
+                {"user_id": {"$ne": ""}}
+            )