[No QA] Fix Fraud Protection backend URL in dev - #71463
Merged
Merged
Conversation
melvin-bot
Bot
requested review from
chuckdries
and removed request for
a team
September 29, 2025 11:12
|
@chuckdries Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| const fp = FP.getInstance(); | ||
|
|
||
| let targetBaseURL; | ||
| let targetBaseURL = oldDotURL; |
Contributor
There was a problem hiding this comment.
❌ LOGIC-1
This variable initialization might be redundant since targetBaseURL is immediately reassigned when env === CONST.ENVIRONMENT.DEV on line 43. Consider initializing it only when needed to avoid potential confusion.
Suggested fix:
let targetBaseURL: string;
if (env === CONST.ENVIRONMENT.DEV) {
targetBaseURL = getApiRoot();
Log.info(`[Fraud Protection] Fraud protection backend URL: ${targetBaseURL}`);
fp.enableDebugLogs();
} else {
targetBaseURL = oldDotURL;
}
| let targetBaseURL = oldDotURL; | ||
| if (env === CONST.ENVIRONMENT.DEV) { | ||
| targetBaseURL = CONFIG.EXPENSIFY.DEFAULT_API_ROOT; | ||
| targetBaseURL = getApiRoot(); |
Contributor
There was a problem hiding this comment.
❌ FUNCTION-1
The getApiRoot() function is called without any parameters, but checking the ApiUtils implementation, it accepts optional parameters (request?: Request, forceProduction = false). Consider if you need to pass any parameters for the specific fraud protection use case.
Reasoning: Without seeing the full context of how the API root should be determined for fraud protection, it's unclear if the default behavior of getApiRoot() is appropriate. You might need to force production behavior or handle secure endpoints differently.
| if (env === CONST.ENVIRONMENT.DEV) { | ||
| targetBaseURL = CONFIG.EXPENSIFY.DEFAULT_API_ROOT; | ||
| targetBaseURL = getApiRoot(); | ||
| Log.info(`[Fraud Protection] Fraud protection backend URL: ${targetBaseURL}`); |
Contributor
There was a problem hiding this comment.
❌ SECURITY-1
Logging the API root URL in development could potentially expose sensitive information about internal endpoints or proxy configurations. Consider if this debug information is necessary or if it should be sanitized.
Reasoning: While this is only enabled in DEV environment, API endpoints can reveal internal infrastructure details that shouldn't be logged even in development builds that might be shared or stored.
cristipaval
changed the title
coleaeason
previously approved these changes
Sep 29, 2025
Contributor
Reviewer Checklist
Screenshots/VideosAndroid: HybridAppAndroid: mWeb ChromeiOS: HybridAppiOS: mWeb SafariMacOS: Chrome / SafariMacOS: Desktop |
chuckdries
previously approved these changes
Sep 29, 2025
chuckdries
left a comment
chuckdries
left a comment
Contributor
There was a problem hiding this comment.
Login works normally in dev. Just need to solve conflicts
cristipaval
dismissed stale reviews from chuckdries and coleaeason
via
September 29, 2025 19:08
e9f5461
Contributor
Author
|
@chuckdries, I dismissed your review by resolving the conflicts, could you please re-approve and merge? 🙏 Thanks! |
chuckdries
approved these changes
Sep 29, 2025
Contributor
|
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
72 tasks done
Contributor
|
🚀 Deployed to staging by https://github.com/chuckdries in version: 9.2.21-0 🚀
|
Contributor
|
🚀 Deployed to production by https://github.com/Julesssss in version: 9.2.21-4 🚀
|
Contributor
|
🚀 Deployed to production by https://github.com/Julesssss in version: 9.2.21-4 🚀
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation of Change
Fixed Issues
$
PROPOSAL:
Tests
Tested by checking that the events get logged to Group-IB devices from physical native devices running the App in dev mode.
Offline tests
QA Steps
// TODO: These must be filled out, or the issue title must include "[No QA]."
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectioncanBeMissingparam foruseOnyxtoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari
MacOS: Desktop