[Due for payment 2026-07-24] [$250] [Sentry: APP-GH] HybridApp Android NullPointerException uriString in ChromeCustomTabsManager

[mountiny]

Sentry

https://expensify.sentry.io/issues/APP-GH

Impact (snapshot at filing)

• Users (total since first seen): 123
• Events: 567
• Users (last 14d, 9.4.x releases): 7
• First seen: 2025-11-04
• Last seen: ongoing
• Platform: Android HybridApp
• App version(s): 9.4.5–9.4.9
• Affected route(s): Chrome Custom Tabs connection
• Mechanism: UncaughtExceptionHandler

Stack trace (top frames, first-party only)

yapl.android.managers.ChromeCustomTabsManager$1.onCustomTabsServiceConnected
android.net.Uri.parse
android.net.Uri$StringUri.<init> (NullPointerException: uriString)

Suspected cause

ChromeCustomTabsManager passes a null URI string when binding custom tabs service.

Reproduction

Unknown — see Sentry events linked from the Sentry issue.

Related

• Prior GH issues: none

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022067266274458912905
• Upwork Job ID: 2067266274458912905
• Last Price Increase: 2026-06-24

Issue Owner

Current Issue Owner: @mallenexpensify

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @Ollyws (External)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022067266274458912905

[MelvinBot]

Issue Analysis

Root Cause: A NullPointerException is thrown when ChromeCustomTabsManager's CustomTabsServiceConnection.onCustomTabsServiceConnected(...) callback passes a null URL string into Uri.parse(...). The stack trace confirms the failure originates inside the service-connected callback, not from user navigation:

ChromeCustomTabsManager$1.onCustomTabsServiceConnected
  → android.net.Uri.parse
    → android.net.Uri$StringUri.<init>  (NullPointerException: uriString)

When the Custom Tabs service binds, the connection callback typically warms up the browser and pre-fetches a likely URL (e.g. session.mayLaunchUrl(Uri.parse(url), …)). The crash means that the target URL held by the manager is null at the moment the service connects — so Uri.parse(null) throws. This is a race/lifecycle issue: the service connection completes (asynchronously) before a valid URL has been set, or after it was cleared.

Recommended Fix: Guard the Uri.parse(...) call inside onCustomTabsServiceConnected — skip the warmup / mayLaunchUrl step (or bail out of the callback) when the stored URL is null or empty, rather than parsing unconditionally. A simple null/blank check before Uri.parse eliminates the crash.

⚠️ This fix lives outside the Expensify/App repo. ChromeCustomTabsManager is native Android (Java) code in the HybridApp (Mobile-Expensify), not in the React Native App codebase. There is no corresponding source in Expensify/App to change. An internal engineer with Mobile-Expensify access needs to apply the null guard and verify against the Sentry events. I can't propose file:line references because I don't have access to that repository.

Investigation details

• Platform is explicitly Android HybridApp; the crashing class yapl.android.managers.ChromeCustomTabsManager is an obfuscated (ProGuard/R8) native Android manager — these do not exist in the public React Native Expensify/App tree (confirmed: no match for ChromeCustomTabsManager / CustomTabsServiceConnected anywhere in App/).
• Mobile-Expensify is a private repo and returned 403 on clone, so I could not read the implementation to provide exact line references.
• The crash signature (Uri$StringUri.<init> with NullPointerException: uriString) is unambiguous: a null was passed to Uri.parse. The only public-API call to Uri.parse inside a CustomTabsServiceConnection callback is the warmup/pre-launch URL.
• Alternative considered: the null could come from a deep-link/intent URL rather than a warmup URL. Either way the fix is the same defensive null check before Uri.parse, and both are in Mobile-Expensify.
• Confidence: High on the mechanism (null → Uri.parse); the exact source location and the precise reason the URL is null require Mobile-Expensify access to confirm.
• No closely related open Expensify/App issues found.

---

Next Steps: This requires changes in Mobile-Expensify (HybridApp), which is outside this repo — please escalate to an internal engineer with access to that repository. Reply with @MelvinBot <your feedback> to refine this analysis.

[KJ21-ENG]

🚨 Edited by proposal-police: This proposal was edited at 2026-06-17 15:56:52 UTC.

Proposal

What is the root cause of that problem?

The failing path is the Android HybridApp Chrome Custom Tabs service connection, not the standalone NewDot Android app. The Sentry stack stops in yapl.android.managers.ChromeCustomTabsManager$1.onCustomTabsServiceConnected at android.net.Uri.parse, and Android throws NullPointerException: uriString when Uri.parse receives null.

The public App checkout confirms why the fix must target the HybridApp native tree: HybridApp native code lives under Mobile-Expensify/Android / Mobile-Expensify/iOS, and changes in App's root android / ios folders do not affect HybridApp builds.

App/contributingGuides/HYBRID_APP.md

Lines 8 to 10 in 6ea10e7

	If you have access to the closed-source `Mobile-Expensify` repository, you are eligible to build HybridApp. The main difference between NewDot and HybridApp is that the native code is located in a different place. The native code is located under `./Mobile-Expensify/Android` and `./Mobile-Expensify/iOS`.
	It is vital to understand, that modifying any code in `./android` and `./ios` folders in the root of the project **will not affect the HybridApp build at all.** In this case, if you'd like to change native code, you have to go to `./Mobile-Expensify/Android` and `./Mobile-Expensify/iOS` first. This is **especially important** when you want to remove native cache or `Pods` manually.

So the root cause is that ChromeCustomTabsManager treats the URL value passed to Uri.parse as required inside onCustomTabsServiceConnected. When that optional value is absent for some HybridApp sessions, the callback still passes the nullable string to Uri.parse, crashing before the Custom Tabs warmup finishes.

What changes do you think we should make in order to solve the problem?

Update the Mobile-Expensify/Android implementation of yapl.android.managers.ChromeCustomTabsManager so the service connection separates Custom Tabs session warmup from the optional URL-specific work:

• keep binding/session creation and warmup as best-effort behavior;
• resolve the URL to a local nullable string and check it is non-empty before calling Uri.parse;
• call mayLaunchUrl(Uri.parse(url), ...) only when that URL exists;
• when no URL is available, skip only the URI-specific call and leave the bound Custom Tabs session available for later explicit opens.

Scope boundaries: files touched: Mobile-Expensify/Android native yapl.android.managers.ChromeCustomTabsManager, specifically onCustomTabsServiceConnected around the existing Uri.parse / mayLaunchUrl path. Platforms: Android HybridApp only. Code paths explicitly not touched: App root android/ standalone NewDot native code, the JS HybridApp bridge, iOS HybridApp, web, and mWeb. API/backend behavior changes: none.

What alternative solutions did you explore? (Optional)

Do not change the App-root android/ Custom URI/deep-link handlers for this crash. The HybridApp guide states that modifying root android / ios does not affect HybridApp builds, so that would miss the crashing binary path.

App/contributingGuides/HYBRID_APP.md

Lines 8 to 10 in 6ea10e7

	If you have access to the closed-source `Mobile-Expensify` repository, you are eligible to build HybridApp. The main difference between NewDot and HybridApp is that the native code is located in a different place. The native code is located under `./Mobile-Expensify/Android` and `./Mobile-Expensify/iOS`.
	It is vital to understand, that modifying any code in `./android` and `./ios` folders in the root of the project **will not affect the HybridApp build at all.** In this case, if you'd like to change native code, you have to go to `./Mobile-Expensify/Android` and `./Mobile-Expensify/iOS` first. This is **especially important** when you want to remove native cache or `Pods` manually.

I also would not substitute a fallback URL such as the New Expensify home page. That avoids the NPE, but it prefetches an unrelated page and hides the real state; skipping mayLaunchUrl when the optional URL is absent preserves the intended best-effort warmup behavior.

[github-actions]

⚠️ @KJ21-ENG Thanks for your proposal. Please update it to follow the proposal template, as proposals are only reviewed if they follow that format (note the mandatory sections).

[delciovelho]

Proposal

Sentry: APP-GH
GitHub: #93843
Platform: Android HybridApp (9.4.x)
Mechanism: NullPointerException — uriString in android.net.Uri.parse
Stack: yapl.android.managers.ChromeCustomTabsManager$1.onCustomTabsServiceConnected
Volume: 567 events, 123 users (7 users in last 14d)

Please re-state the problem that we are trying to solve in this issue.

On Android HybridApp, the app crashes with a native NullPointerException when Chrome Custom Tabs (CCT) connects. Sentry shows the failure inside ChromeCustomTabsManager$1.onCustomTabsServiceConnected → Uri.parse, meaning uriString is null at parse time. This is not a JS exception — it happens in OldDot’s YAPL Android layer while binding/warming the Custom Tabs service.

The crash is HybridApp-only (not web, not standalone NewDot), affects a long tail of users (123 total, still active on 9.4.x), and has no single screen in breadcrumbs — consistent with a shared URL-opening primitive used across many flows (external links, OAuth, OldDot handoffs).

What is the root cause of that problem?

There are two layers: a native defect (primary) and App-repo URL emission gaps (secondary amplifier).

1. Primary (Mobile-Expensify) — ChromeCustomTabsManager calls Uri.parse on a null pending URL

The Mobile-Expensify submodule is not checked out in this workspace, but the class and call chain are documented in #61733 and match the Sentry stack:

• YAPL exposes openBrowser(String url, …) which routes external URLs through ChromeCustomTabsManager.getInstance().open(url, …).
• The HybridApp Kotlin bridge forwards nullable url: String? straight through:

// Mobile-Expensify (from #61733 proposal snippet)
override fun openBrowser(url: String?, successCallback: Callback?, failureCallback: Callback?) {
    Yapl.getInstance().openBrowser(url, null, null);
}

• ChromeCustomTabsManager is a singleton that binds the Custom Tabs service eagerly (warmup / mayLaunchUrl prefetch pattern). When onCustomTabsServiceConnected fires, it appears to call Uri.parse(pendingUrl) before validating that a URL was set.

Uri.parse(null) throws NullPointerException on Android (unlike Uri.parse(""), which returns an empty URI). That exactly matches the Sentry signature.

Most likely trigger scenarios (native):

Scenario	How uriString becomes null
Eager bind race	Manager calls bindCustomTabsService at init/warmup; onCustomTabsServiceConnected runs mayLaunchUrl(Uri.parse(pendingUrl)) while pendingUrl is still null because no open() has been called yet.
Null bridge argument	OldDot JS or a native caller invokes openBrowser(null); Kotlin does not guard url before passing to YAPL.
Stale callback after clear	A previous open() stored a URL, then cleared it; a late service-reconnect callback still tries to prefetch with the cleared field.

MelvinBot’s diagnosis (guard before warmup / mayLaunchUrl) is correct for the native layer. This proposal adds structural fixes: don’t call mayLaunchUrl until a non-null URL exists, and reject null at open() entry.

2. Secondary (App-repo) — NewDot can still reach the same native CCT path with weak validation

The App repo contains zero references to ChromeCustomTabs, CustomTabs, or ChromeCustomTabsManager. External URLs from NewDot flow through Linking.openURL, which on HybridApp Android is overridden in Mobile-Expensify to use the same CCT manager (per #61733).

Central path — asyncOpenURL → Linking.openURL:

const asyncOpenURL: AsyncOpenURL = (promise, url) => {
    if (!url) {
        return;
    }

    promise
        .then((params) => {
            Linking.openURL(typeof url === 'string' ? url : url(params));
        })
        .catch(() => {
            const safeUrl = typeof url === 'string' ? sanitizeUrlForLogging(url) : '[function]';
            Log.warn('[asyncOpenURL] error occurred while opening URL', {url: safeUrl});
        });
};

Problems:

1. Guard is pre-resolution only. When url is a function (e.g. openOldDotLink, openTravelDotLink, sign-out redirect in Session/index.ts), the function object is truthy, so the early return never fires — but the resolved string can be '' or otherwise invalid after the promise settles.
2. No post-resolution validation before Linking.openURL.
3. Bypass paths call Linking.openURL directly, skipping even the weak guard:

function AnchorForCommentsOnly({onPress, href = '', ...props}: AnchorForCommentsOnlyProps) {
    const onLinkPress = () => {
        if (onPress) {
            onPress();
        } else {
            Linking.openURL(href);
        }
    };

href defaults to ''; malformed chat HTML with a missing href can open an empty URL on press.

What does not go through CCT from NewDot anymore: Travel on native now opens an in-app WebView, not Custom Tabs:

const openTravelDotLink = (activePolicyID?: string, postLoginPath?: string, spotnanaToken?: string, isTestAccount?: boolean) => {
    if (spotnanaToken) {
        Navigation.navigate(ROUTES.TRAVEL_DOT_LINK_WEB_VIEW.getRoute(spotnanaToken, isTestAccount, postLoginPath));
        return;

So remaining NewDot → CCT traffic is primarily openExternalLink / openLink / direct Linking.openURL (help links, Calendly, accounting OAuth, OldDot links, PDFs, announcements, etc.) — roughly 40+ call sites via openExternalLink/openLink, plus ~10 direct Linking.openURL usages.

HybridApp bridge: @expensify/react-native-hybrid-app does not expose openBrowser today (modules/hybrid-app/src/types.ts), so NewDot cannot call YAPL’s CCT path directly — it relies on the Linking.openURL override. OldDot YAPL JS still calls openBrowser natively and is a separate null-source.

What changes do you think we should make in order to solve the problem?

Primary fix belongs in Mobile-Expensify. App-repo changes are defense-in-depth and should ship alongside, not instead of, the native fix.

A. Mobile-Expensify — ChromeCustomTabsManager (primary)

File: Mobile-Expensify/app/yapl/android/managers/ChromeCustomTabsManager.java (exact path per package yapl.android.managers).

1. Reject null/blank at open() entry — log + invoke failure callback; never store null as pendingUrl.
2. Defer mayLaunchUrl until URL is set — in onCustomTabsServiceConnected, only prefetch when pendingUrl != null && !pendingUrl.isEmpty(); always safe to call warmup(0) without a URI.
3. Clear pendingUrl after launch or on failure to prevent stale reconnect callbacks from re-parsing a cleared field.
4. Guard Kotlin bridge — reject url.isNullOrBlank() before Yapl.getInstance().openBrowser(…).

 // ChromeCustomTabsManager.java (illustrative)
 public void open(@Nullable String url, ...) {
+    if (url == null || url.trim().isEmpty()) {
+        Yapl.logWarning("[ChromeCustomTabsManager] open() called with null/empty URL");
+        if (failureCallback != null) failureCallback.call();
+        return;
+    }
     this.pendingUrl = url;
     bindServiceIfNeeded();
 }

 // Inner class ChromeCustomTabsManager$1
 public void onCustomTabsServiceConnected(...) {
     mClient = client;
     mClient.warmup(0);
-    mSession.mayLaunchUrl(Uri.parse(pendingUrl), null, null);
+    if (pendingUrl != null && !pendingUrl.isEmpty()) {
+        mSession.mayLaunchUrl(Uri.parse(pendingUrl), null, null);
+    }
 }

 // HybridApp ReactNative bridge (Kotlin)
 override fun openBrowser(url: String?, successCallback: Callback?, failureCallback: Callback?) {
+    if (url.isNullOrBlank()) {
+        failureCallback?.invoke("URL is null or empty")
+        return
+    }
     Yapl.getInstance().openBrowser(url, null, null)
 }

B. App repo — harden URL validation before Linking.openURL (secondary)

Add a shared validator and route all native external opens through it.

B1. src/libs/openExternalURL.ts

import {Linking} from 'react-native';
import Log from '@libs/Log';

function isOpenableExternalURL(url: unknown): url is string {
    return typeof url === 'string' && url.trim().length > 0;
}

function openExternalURL(url: unknown, context?: string): boolean {
    if (!isOpenableExternalURL(url)) {
        Log.warn('[openExternalURL] skipped — invalid URL', {context, urlType: typeof url});
        return false;
    }
    Linking.openURL(url.trim());
    return true;
}

export {isOpenableExternalURL, openExternalURL};

B2. src/libs/asyncOpenURL/index.ts — validate resolved URL

 promise
     .then((params) => {
-        Linking.openURL(typeof url === 'string' ? url : url(params));
+        const resolved = typeof url === 'string' ? url : url(params);
+        openExternalURL(resolved, 'asyncOpenURL');
     })

B3. src/libs/actions/Link.ts — early return in openExternalLink / openLink

 function openExternalLink(url: string, ...) {
+    if (!isOpenableExternalURL(url)) {
+        Log.warn('[Link] openExternalLink skipped — invalid URL');
+        return;
+    }
     asyncOpenURL(Promise.resolve(), url, ...);
 }

 function openLink(href: string, environmentURL: string, isAttachment = false) {
+    if (!isOpenableExternalURL(href)) {
+        Log.warn('[Link] openLink skipped — invalid href');
+        return;
+    }
     // ... existing routing logic
 }

B4. Replace direct Linking.openURL on native — at minimum AnchorForCommentsOnly/index.native.tsx, PDFView/index.native.tsx, and Header.tsx (uses subTitleLink which may be undefined). Prefer openExternalURL or openExternalLink so all paths share validation.

B5. Optional Sentry breadcrumb — when openExternalURL skips, add Sentry.addBreadcrumb({category: 'link.open', message: 'skipped_invalid_url', data: {context}}) to correlate remaining APP-GH events post-fix.

C. What we should NOT do in App repo

• Do not add HybridAppModule.openBrowser unless we have a concrete NewDot flow that must bypass Linking — current architecture intentionally uses Linking.openURL override (src/setup/hybridApp/index.native.ts only shadows getInitialURL, not openURL; the CCT override lives in Mobile-Expensify).
• Do not treat this as fixable by Travel WebView changes — that path is already migrated on native.

Alternatives considered

1. Native-only null guard (MelvinBot) — necessary and sufficient to stop the crash; does not reduce how often null URLs are emitted from JS. Ship this regardless.
2. Defer CCT service bind entirely until first open() — eliminates the eager-bind race but adds latency to the first external link. Prefer keeping warmup(0) on connect but skipping mayLaunchUrl without a URL (option A).
3. Catch NPE around Uri.parse only — masks programming errors; reject null at source instead.
4. Replace CCT with WebView for all external links on Android — large UX/security regression (OAuth, cookies, SAML); out of scope.
5. App-only fix — insufficient: OldDot YAPL calls openBrowser without going through NewDot asyncOpenURL; the service-connection race is entirely native.

Test / verification plan

Mobile-Expensify (primary)

1. Unit/instrumentation: call ChromeCustomTabsManager.open(null) → no crash, failure callback invoked.
2. Cold start HybridApp Android without opening any external link → no crash in onCustomTabsServiceConnected (validates eager-bind race fix).
3. Open a known external URL (help link, Calendly) → CCT opens normally.
4. OldDot flow that uses yaplOpenBrowser (accounting OAuth) → still works.

App repo (secondary)

1. Unit test openExternalURL: rejects null, '', ' '; accepts valid HTTPS URL.
2. Unit test asyncOpenURL: when promise resolves to '', Linking.openURL is not called.
3. Manual HybridApp Android: tap chat link with empty href → no crash, no-op with log.
4. Regression: openOldDotLink, sign-out redirect (Session/index.ts asyncOpenURL), Calendly booking — links still open.

Sentry validation (post-merge)

• Filter APP-GH for Android HybridApp 9.4.x+.
• Compare 14-day event/user counts before vs after Mobile-Expensify fix.
• If events persist, inspect new link.open / [openExternalURL] skipped breadcrumbs to see whether nulls originate from NewDot or OldDot.

CI

• npm run test (new openExternalURL / asyncOpenURL tests)
• npm run typecheck-tsgo
• npm run lint-changed

[lorretheboy]

🚫 Duplicated proposal withdrawn by 🤖 ProposalPolice.