From b545bfed3dfb203c40643b0c32cc930b206c660a Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Tue, 12 May 2026 14:49:04 -0400 Subject: [PATCH] Fix esc(None) TypeError and javascript: scheme in PO web UI Coerce supplier name through `or ""` before escaping to handle nested None from DynamoDB. Add scheme allowlist on view_order_url to block javascript:/data: hrefs from LLM-extracted URLs. --- lambdas/po/web_ui/handler.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lambdas/po/web_ui/handler.py b/lambdas/po/web_ui/handler.py index f9cc6a4..a3b3b74 100644 --- a/lambdas/po/web_ui/handler.py +++ b/lambdas/po/web_ui/handler.py @@ -71,7 +71,7 @@ def render_po_detail(po): ("Email Type", render_badge(po.get("email_type", ""), EMAIL_TYPE_COLORS)), ("Total Amount", fmt_currency(po.get("total_amount"))), ("Currency", esc(po.get("currency", "")) or None), - ("Supplier", esc((po.get("supplier") or {}).get("name", "")) or None), + ("Supplier", esc((po.get("supplier") or {}).get("name") or "") or None), ("Site Code", esc(po.get("site_code", "")) or None), ("State", esc(po.get("state", "")) or None), ("Trade", esc(po.get("trade", "")) or None), @@ -102,7 +102,7 @@ def render_po_detail(po): fields.append(("Ship To", "
".join(ship_parts))) view_url = po.get("view_order_url") - if view_url: + if view_url and view_url.startswith(("https://", "http://")): escaped_url = esc(view_url, quote=True) fields.append( (