-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add extra check before accessing whisperedTo #44456
add extra check before accessing whisperedTo #44456
Conversation
🧪🧪 Use the links below to test this adhoc build on Android, iOS, Desktop, and Web. Happy testing! 🧪🧪 |
src/libs/ReportActionsUtils.ts
Outdated
return originalMessage?.whisperedTo ?? []; | ||
} | ||
|
||
if (typeof originalMessage !== 'object') { | ||
Log.info('Original message is not an object for reportAction: ', true, reportAction); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We cannot log the entire report action, that has sensitive data. only its ID and type
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are some places in ReportActionUtils
where the reportAction
is logged like here so I followed that.
I will push a commit.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if (typeof originalMessage !== 'object') {
Log.info('Original message is not an object for reportAction: ', true, {"reportActionID" : reportAction?.reportActionID, "actionName" : reportAction?.actionName});
}
This is fine, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We probably redact the sensitive fields in the backend but still safer to just send the reportActionID
Reviewer Checklist
Screenshots/VideosSimple change to access the value correctly and safely Android: NativeAndroid: mWeb ChromeiOS: NativeiOS: mWeb SafariMacOS: Chrome / SafariMacOS: Desktop |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, lets hope this will work
InternalQA is for @muttmuure or @miljakljajic to test once this hits staging if they can load app fine |
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
🚀 Deployed to production by https://github.com/jasperhuangg in version: 9.0.3-7 🚀
|
🚀 Deployed to production by https://github.com/Julesssss in version: 9.0.5-13 🚀
|
@mountiny I have a user who encountered this issue 2 weeks ago, it was fixed for them, but now it's back. Do you think it's related to the same cause? |
@sonialiap Can you please post the error screenshot? @mountiny I think this is due to this use. App/src/libs/ReportActionsUtils.ts Line 669 in b8b99d0
I can make a PR for this. |
@c3024 might be a good fix, but I could not see these logs in the linked issue @sonialiap do you have logs with this error somewhere? thanks! |
I think error logs or console logs are required for correctly fixing this. It could be a different error as well. cc: @mountiny |
We'll ask the clients for a screenshot with the JS log |
Details
The app crashed for some users due to the error "Type Error: Cannot use 'in' operator to search for 'whisperedTo' in []". This error occurred when attempting to access
whisperedTo
in an empty array[]
. It appears that whenoriginalMessage
is an array, it is empty. To prevent this issue, this pull request introduces a check to ensure that bothoriginalMessage
andmessage
are objects before attempting to accesswhisperedTo
. If either is not an object, the function will return an empty array[]
, which is the expected behavior even whenoriginalMessage
is an empty array.Fixed Issues
$ #44392
PROPOSAL:
Tests
Offline tests
QA Steps
Same as Tests
PR Author Checklist
### Fixed Issues
section aboveTests
sectionOffline steps
sectionQA steps
sectiontoggleReport
and notonIconClick
)myBool && <MyComponent />
.src/languages/*
files and using the translation methodSTYLE.md
) were followedAvatar
, I verified the components usingAvatar
are working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
)Avatar
is modified, I verified thatAvatar
is working as expected in all cases)Design
label and/or tagged@Expensify/design
so the design team can review the changes.ScrollView
component to make it scrollable when more elements are added to the page.main
branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTest
steps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari
MacOS: Desktop