fix(invoice): prevent writing "None" when agent_notes is None#221
Open
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Open
fix(invoice): prevent writing "None" when agent_notes is None#221Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Conversation
Signed-off-by: JEAN REGIS <240509606@firat.edu.tr>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes issue #149 where calling
update_invoice_agent_noteswithagent_notes=Nonewould append the literal string"None"to the invoice's agent notes.Problem
When
agent_notes=Noneis passed, the f‑stringf"{existing_notes}\n\n{agent_notes}"coercesNoneto"None", resulting in the notes field containing"\n\nNone". This corrupts the audit trail and causes false positives in detectors scanning for meaningful content.Root Cause
The function lacks a guard for
Nonebefore interpolating the value. The f‑string conversion is implicit and irreversible.Solution
Added an early return before the f‑string: if
agent_notesisNone, we return the current invoice state without any update. This keeps the notes unchanged, matching the expected behavior that aNoneinput should not modify the notes.Impact
Nonegracefully.Testing
test_inv_notes_004_none_agent_notes_inserts_literal_nonenow passes.test_inv_notes_001,test_inv_notes_002) still pass."None"appears in notes after the fix.