Parser hardening + brand aliases: multi-issuer layouts, NUL/trim/control-char safety

app/statement_parser.py

@@ -102,7 +102,7 @@ def _split_glued_city(s: str) -> str:
 
 
 def _clean_merchant(raw: str) -> str:
-    original = (raw or "").strip()
+    original = re.sub(r"[\x00-\x1f\x7f]+", " ", (raw or "")).strip()   # never show control chars in a name
     strip = lambda x: re.sub(r"^[\s*.,\-]+|[\s*.,\-]+$", "", x).strip()
     if re.search(r"paypal", original, re.IGNORECASE):
         m = re.search(r"paypal\s*\*?\s*([a-z][a-z0-9 &._-]{1,24})", original, re.IGNORECASE)
@@ -119,8 +119,8 @@ def _clean_merchant(raw: str) -> str:
     s = re.sub(r"\*+", " ", s)
     s = strip(re.sub(r"\s{2,}", " ", s))
     if len(s) < 2:
-        return original[:40] or "Transaction"
-    return _title(_split_glued_city(s))[:40]
+        return original[:40].strip() or "Transaction"
+    return _title(_split_glued_city(s))[:40].strip()   # trim AFTER truncation so a cut long name has no trailing space
 
 
 def _parse_date(s: str) -> Optional[str]:
@@ -213,6 +213,7 @@ def parse_csv(content: bytes) -> List[Dict]:
     skipped so only real spends feed the optimal-card analysis.
     """
     text = content.decode("utf-8-sig", errors="ignore")
+    text = text.replace("\x00", "")   # NUL bytes (corrupt/binary upload) make csv.reader raise
     delim = _detect_delimiter(text)
     lines = [ln for ln in text.splitlines() if ln.strip()]
     rows = [[c.strip() for c in _split_line(ln, delim)] for ln in lines]