Fix: Enable strict HTML tag validation on tax name forms by MelvinBot · Pull Request #84872 · Expensify/App

MelvinBot · 2026-03-11T11:59:46Z

Explanation of Change

Tax names containing certain angle bracket patterns (e.g., GST<10%>) bypass the default HTML tag validation regex (VALIDATE_FOR_HTML_TAG_REGEX) because the pattern <10%> doesn't match valid HTML-like tag syntax. However, the backend WAF strips any angle-bracketed content, creating a mismatch: the frontend optimistically saves GST<10%> while the backend creates GST, resulting in duplicate tax rates and broken selection.

The codebase already has STRICT_VALIDATE_FOR_HTML_TAG_REGEX and a shouldUseStrictHtmlTagValidation prop on FormProvider that catches any content in angle brackets. This PR enables that strict validation on both the tax rate creation and tax rate rename forms, consistently rejecting names like GST<10%> before submission.

Additionally, the same fix is applied to the Report Fields creation page, where the field name input also uses TextPicker and is susceptible to the same WAF stripping issue.

Fixed Issues

$ #83183
PROPOSAL: #83183 (comment)

Tests

Tax rates:

Go to a workspace and enable taxes
Go to Workspace > Taxes and click Add rate
Enter a tax name containing angle brackets, e.g. GST<10%>
Verify the "Invalid character" error is shown immediately
Enter a valid tax name without angle brackets (e.g. GST 10%), set a value, and save
Verify the tax rate is created successfully
Click on the newly created tax rate, then tap the name to edit it
Try renaming it to something with angle brackets, e.g. Tax<Rate>
Verify the "Invalid character" error is shown
Rename it to a valid name and save successfully

Report fields:

Go to a workspace and navigate to More features
Enable Report fields
Go to Workspace > Report fields and tap Add field
Tap the Name field and enter a name containing angle brackets, e.g. Field<test>
Verify the "Invalid character" error is shown
Enter a valid name (e.g. Field test), select a type, and save
Verify the report field is created successfully

Verify that no errors appear in the JS console

Offline tests

The validation is purely client-side and runs before any API call, so offline behavior is unchanged. The form still works offline with enabledWhenOffline — it just now also rejects angle bracket patterns.

QA Steps

Tax rates:

Go to a workspace and enable taxes
Go to Workspace > Taxes and click Add rate
Enter a tax name like GST<10%> and try to save
Verify an "Invalid character" error appears and the form does not submit
Enter a valid tax name (e.g. GST 10%), set a value, and save successfully
Tap the created tax rate, then tap the name to edit
Try renaming to Tax<5%> — verify "Invalid character" error appears
Rename to a valid name and verify it saves

Report fields:

Go to a workspace and navigate to More features
Enable Report fields
Go to Workspace > Report fields and tap Add field
Tap the Name field and enter a name with angle brackets, e.g. Field<test>
Verify an "Invalid character" error appears and the form does not submit
Enter a valid name (e.g. Field test), select a type, and save successfully
Verify the report field is created successfully

Verify that no errors appear in the JS console