[$125] Excel tag files should not be allowed to be uploaded

[francoisl]

Version Number: 9.2.86-4
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: N/A
Email or phone of affected tester (no customers): Any
Logs: https://www.expensify.com/_devportal/tools/logSearch/#query=request_id:(%229b1373ddaba7eee7-ATL%22)+_time:[2025-12-21T00:02:12.225Z,+2025-12-21T02:02:12.225Z]&index=victorialogs&engine=victorialogs
Expensify/Expensify Issue URL: https://github.com/Expensify/Expensify/issues/569198
Issue reported by: Bugbot

Action Performed:

1. Create a policy
2. Enable tag import
3. Go to Tags > Import > Multi-level tags
4. Select an XLSX file (example)
5. Notice how the client will let you try to upload it
6. Notice how the backend will not process it, and return an error

Expected Result:

We shouldn't let you upload XLS/XLSX files

Actual Result:

The client allows users to submit excel tag files, then the backend cannot process them

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Same flow in Classic:

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022005769728901073024
• Upwork Job ID: 2005769728901073024
• Last Price Increase: 2026-01-05
• Automatic offers:
• ijmalik | Contributor | 110006839

Issue Owner

Current Issue Owner: @

Issue Owner

Current Issue Owner: @bfitzexpensify

[melvin-bot]

Triggered auto assignment to @bfitzexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[francoisl]

@yuwenmemon - assigned you based on 1:1 conversation and marked as internal in case you want to work with a specific contributor on this

[ijmalik]

🚨 Edited by proposal-police: This proposal was edited at 2025-12-30 06:10:55 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Excel tag files should not be allowed to be uploaded

What is the root cause of that problem?

App/src/CONST/index.ts

Lines 277 to 281 in 2dcf2fc

	// Allowed extensions for spreadsheets import
	ALLOWED_SPREADSHEET_EXTENSIONS: ['xls', 'xlsx', 'csv', 'txt'],
	// Allowed extensions for multilevel tag spreadsheets
	MULTILEVEL_TAG_ALLOWED_SPREADSHEET_EXTENSIONS: ['csv', 'tsv'],

App/src/components/ImportSpreadsheet.tsx

Lines 66 to 78 in 2dcf2fc

	const validateFile = (file: FileObject) => {
	const {fileExtension} = splitExtensionFromFileName(file?.name ?? '');
	if (!CONST.ALLOWED_SPREADSHEET_EXTENSIONS.includes(fileExtension.toLowerCase() as TupleToUnion<typeof CONST.ALLOWED_SPREADSHEET_EXTENSIONS>)) {
	setUploadFileError(true, 'attachmentPicker.wrongFileType', 'attachmentPicker.notAllowedExtension');
	return false;
	}
	if ((file?.size ?? 0) <= 0) {
	setUploadFileError(true, 'attachmentPicker.attachmentTooSmall', 'spreadsheet.sizeNotMet');
	return false;
	}
	return true;
	};

Currently system validated file extensions against:

CONST.ALLOWED_SPREADSHEET_EXTENSIONS

This constant includes Excel formats: ['xls', 'xlsx', 'csv', 'txt']

As a result, during *multi-level tag import, the client allowed .xls and .xlsx files to be uploaded, even though the backend only supports *CSV/TSV for that flow.

What changes do you think we should make in order to solve the problem?

Replace

App/src/components/ImportSpreadsheet.tsx

Lines 66 to 78 in 2dcf2fc

	const validateFile = (file: FileObject) => {
	const {fileExtension} = splitExtensionFromFileName(file?.name ?? '');
	if (!CONST.ALLOWED_SPREADSHEET_EXTENSIONS.includes(fileExtension.toLowerCase() as TupleToUnion<typeof CONST.ALLOWED_SPREADSHEET_EXTENSIONS>)) {
	setUploadFileError(true, 'attachmentPicker.wrongFileType', 'attachmentPicker.notAllowedExtension');
	return false;
	}
	if ((file?.size ?? 0) <= 0) {
	setUploadFileError(true, 'attachmentPicker.attachmentTooSmall', 'spreadsheet.sizeNotMet');
	return false;
	}
	return true;
	};

With

    const validateFile = (file: FileObject) => {
        const {fileExtension} = splitExtensionFromFileName(file?.name ?? '');
        const lowerExt = fileExtension.toLowerCase();

        if (isImportingMultiLevelTags) {
            if (!CONST.MULTILEVEL_TAG_ALLOWED_SPREADSHEET_EXTENSIONS.includes(lowerExt as TupleToUnion<typeof CONST.MULTILEVEL_TAG_ALLOWED_SPREADSHEET_EXTENSIONS>)) {
                setUploadFileError(true, 'attachmentPicker.wrongFileType', 'attachmentPicker.notAllowedExtension');
                return false;
            }
        } else {
            if (!CONST.ALLOWED_SPREADSHEET_EXTENSIONS.includes(lowerExt as TupleToUnion<typeof CONST.ALLOWED_SPREADSHEET_EXTENSIONS>)) {
                setUploadFileError(true, 'attachmentPicker.wrongFileType', 'attachmentPicker.notAllowedExtension');
                return false;
            }
        }    

        if ((file?.size ?? 0) <= 0) {
            setUploadFileError(true, 'attachmentPicker.attachmentTooSmall', 'spreadsheet.sizeNotMet');
            return false;
        }
        return true;
    };

What alternative solutions did you explore? (Optional)

[melvin-bot]

@yuwenmemon, @bfitzexpensify Whoops! This issue is 2 days overdue. Let's get this updated quick!

[yuwenmemon]

Hmmm, yeah, not sure how these are getting through... cc @allgandalf just as an FYI

[yuwenmemon]

This is External since the CSV/TSV data is parsed front-end and then later sent to the back-end.