Skip to content

fix(invoice): prevent writing "None" when agent_notes is None#221

Open
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M:patch-13
Open

fix(invoice): prevent writing "None" when agent_notes is None#221
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M:patch-13

Conversation

@Jean-Regis-M
Copy link
Copy Markdown
Contributor

Summary

Fixes issue #149 where calling update_invoice_agent_notes with agent_notes=None would append the literal string "None" to the invoice's agent notes.

Problem

When agent_notes=None is passed, the f‑string f"{existing_notes}\n\n{agent_notes}" coerces None to "None", resulting in the notes field containing "\n\nNone". This corrupts the audit trail and causes false positives in detectors scanning for meaningful content.

Root Cause

The function lacks a guard for None before interpolating the value. The f‑string conversion is implicit and irreversible.

Solution

Added an early return before the f‑string: if agent_notes is None, we return the current invoice state without any update. This keeps the notes unchanged, matching the expected behavior that a None input should not modify the notes.

Impact

  • No breaking changes: All existing calls with string arguments behave identically.
  • Minimal diff: Only a few lines added, isolated to one function.
  • Improved correctness: The function now handles None gracefully.

Testing

  • Verified with the provided test: test_inv_notes_004_none_agent_notes_inserts_literal_none now passes.
  • Confirmed existing tests (test_inv_notes_001, test_inv_notes_002) still pass.
  • Manual inspection confirms no "None" appears in notes after the fix.

Signed-off-by: JEAN REGIS <240509606@firat.edu.tr>
@Jean-Regis-M Jean-Regis-M marked this pull request as ready for review March 17, 2026 15:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant