[HOLD for payment 2024-02-07] [$500] Display Name - User can save Expensify and Concierge as a last name while error is thrown

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

Version Number: 1.4.24-0
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: Applause - Internal Team
Slack conversation:

Action Performed:

Navigate to Settings > Profile > Display Name
Enter either 'Expensify' or 'Concierge' as the last name
Click on 'Save' button

Expected Result:

User shouldn't be able to save the 'Expensify' or 'Concierge' as last name

Actual Result:

User is able to save the 'Expensify' or 'Concierge' as last name

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

Screenshots/Videos

Add any screenshot/video evidence

Bug6338345_1704929835247.Screen_Recording_2024-01-10_at_10.34.33_at_night.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~01afa29712aeb0580b
Upwork Job ID: 1745234409296494592
Last Price Increase: 2024-01-18
Automatic offers:

fedirjh | Reviewer | 28119205
dukenv0307 | Contributor | 28119206

Job added to Upwork: https://www.upwork.com/jobs/~01afa29712aeb0580b

@zanyrenney

Triggered auto assignment to @zanyrenney (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

@fedirjh

Triggered auto assignment to Contributor-plus team member for initial proposal review - @fedirjh (External)

Proposal

Please re-state the problem that we are trying to solve in this issue.

Display Name - User can save Expensify and Concierge as a last name while error is thrown

What is the root cause of that problem?

This happens as we are not checking the lastName for reserved words on this page:

App/src/pages/settings/Profile/DisplayNamePage.js

Lines 56 to 72 in 8a559fd

    
           const validate = (values) => { 
        
               const errors = {}; 
        
               // First we validate the first name field 
        
               if (!ValidationUtils.isValidDisplayName(values.firstName)) { 
        
                   ErrorUtils.addErrorMessage(errors, 'firstName', 'personalDetails.error.hasInvalidCharacter'); 
        
               } 
        
               if (ValidationUtils.doesContainReservedWord(values.firstName, CONST.DISPLAY_NAME.RESERVED_FIRST_NAMES)) { 
        
                   ErrorUtils.addErrorMessage(errors, 'firstName', 'personalDetails.error.containsReservedWord'); 
        
               } 
        
               // Then we validate the last name field 
        
               if (!ValidationUtils.isValidDisplayName(values.lastName)) { 
        
                   errors.lastName = 'personalDetails.error.hasInvalidCharacter'; 
        
               } 
        
               return errors; 
        
           };

What changes do you think we should make in order

We should add error checking like we did for first Name

if (ValidationUtils.doesContainReservedWord(values.lastName, CONST.DISPLAY_NAME.RESERVED_LAST_NAMES)) { 
   ErrorUtils.addErrorMessage(errors, 'firstName', 'personalDetails.error.containsReservedWord'); 
}

Alternatively

We may add failure data for this request here:

App/src/libs/actions/PersonalDetails.ts

Line 134 in c8631be

function updateDisplayName(firstName: string, lastName: string) {

Proposal

Please re-state the problem that we are trying to solve in this issue.

Display Name - User can save Expensify and Concierge as a last name while error is thrown

What is the root cause of that problem?

We dont check if the last name is one of the reserved words similar to first name

App/src/pages/settings/Profile/DisplayNamePage.js

Lines 63 to 65 in 9208c95

    
           if (ValidationUtils.doesContainReservedWord(values.firstName, CONST.DISPLAY_NAME.RESERVED_FIRST_NAMES)) { 
        
               ErrorUtils.addErrorMessage(errors, 'firstName', 'personalDetails.error.containsReservedWord'); 
        
           }

What changes do you think we should make in order to solve the problem?

we need to add a validation here for the last name as well

 if (ValidationUtils.doesContainReservedWord(values. lastName, CONST.DISPLAY_NAME.RESERVED_FIRST_NAMES)) { 
         ErrorUtils.addErrorMessage(errors, 'lastName', 'personalDetails.error.containsReservedWord'); 
     }

Proposal

Please re-state the problem that we are trying to solve in this issue.

User is able to save the 'Expensify' or 'Concierge' as last name

What is the root cause of that problem?

In here, we're not validating that the lastName doesn't contain the reserved words similar to what we did with the first name
When we save the legal name (also has first name and last name), if the display names are not set, it will also set the displayName to same as legal name. So the user can save reserved words like Expensify and Concierge as legal name and it will be shown as the display name, and then if the user goes to the display name page and click Save it will show error. We don't currently have any reserved words validation for legal name.

What changes do you think we should make in order to solve the problem?

Validate reserved words for lastName here similar to for first name. We might want to change RESERVED_FIRST_NAMES to RESERVED_NAMES because it doesn't just apply to first name
Add reserved words validation for both first name and last name, to the legal name page. We can optionally fix the back-end to reject legal names that contain reserved words as well

What alternative solutions did you explore? (Optional)

We should additionally evaluate other names like workspace names, room names, personal bank information first & last names, ... to see if we should apply the same reserved words restriction, I think it makes sense to restrict in those places as well to reduce frauds.

Another approach for 2, is to remove the linkage between Legal name and Display name, so if Display name is not already set, when we set Legal name, it should not set Display name to the same values.

@puneetlath

I think it's intentional to validate only first name but not last name. And it's what backend already does.
Originally implemented in #14873 to fix #13779
cc: @puneetlath

@mkhutornyi

I think it's intentional to validate only first name but not last name. And it's what backend already does.

@mkhutornyi It seems that the backend also validates the last name and that’s why it throws this error :

Reviewing label has been removed, please complete the "BugZero Checklist".

@fedirjh

The solution for this issue has been 🚀 deployed to production 🚀 in version 1.4.34-1 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

fix: add validate to last name and legal name #35227

If no regressions arise, payment will be issued on 2024-02-07. 🎊

For reference, here are some details about the assignees on this issue:

@fedirjh requires payment automatic offer (Reviewer)
@dukenv0307 requires payment automatic offer (Contributor)

@fedirjh

BugZero Checklist: The PR fixing this issue has been merged! The following checklist (instructions) will need to be completed before the issue can be closed:

[@fedirjh] The PR that introduced the bug has been identified. Link to the PR:
[@fedirjh] The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake. Link to comment:
[@fedirjh] A discussion in #expensify-bugs has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner. Link to discussion:
[@fedirjh] Determine if we should create a regression test for this bug.
[@fedirjh] If we decide to create a regression test for the bug, please propose the regression test steps to ensure the same bug will not reach production again.
[@zanyrenney] Link the GH issue for creating/updating the regression test once above steps have been agreed upon:

@fedirjh

Payment summary

@fedirjh requires payment automatic offer (Reviewer) - PAID $500
@dukenv0307 requires payment automatic offer (Contributor) PAID $500

Navigation Menu

Repository navigation

[HOLD for payment 2024-02-07] [$500] Display Name - User can save Expensify and Concierge as a last name while error is thrown #34304

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order

Alternatively

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

What alternative solutions did you explore? (Optional)

33 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	const validate = (values) => {
	const errors = {};

	// First we validate the first name field
	if (!ValidationUtils.isValidDisplayName(values.firstName)) {
	ErrorUtils.addErrorMessage(errors, 'firstName', 'personalDetails.error.hasInvalidCharacter');
	}
	if (ValidationUtils.doesContainReservedWord(values.firstName, CONST.DISPLAY_NAME.RESERVED_FIRST_NAMES)) {
	ErrorUtils.addErrorMessage(errors, 'firstName', 'personalDetails.error.containsReservedWord');
	}

	// Then we validate the last name field
	if (!ValidationUtils.isValidDisplayName(values.lastName)) {
	errors.lastName = 'personalDetails.error.hasInvalidCharacter';
	}
	return errors;
	};

[HOLD for payment 2024-02-07] [$500] Display Name - User can save Expensify and Concierge as a last name while error is thrown #34304

Description

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Activity

melvin-bot commented on Jan 11, 2024

melvin-bot commented on Jan 11, 2024

melvin-bot commented on Jan 11, 2024

neonbhai commented on Jan 11, 2024

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order

Alternatively

abzokhattab commented on Jan 11, 2024

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

dukenv0307 commented on Jan 11, 2024

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

What alternative solutions did you explore? (Optional)

mkhutornyi commented on Jan 11, 2024

fedirjh commented on Jan 11, 2024

33 remaining items

melvin-bot commented on Jan 31, 2024

melvin-bot commented on Jan 31, 2024

melvin-bot commented on Jan 31, 2024

zanyrenney commented on Feb 7, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions