Merge pull request Expensify#68208 from callstack-internal/fix/67875-validation-loophole

fix: Validation loophole in global reimbursements

Author: madmax330

src/pages/ReimbursementAccount/NonUSD/utils/getInitialSubStepForBankInfoStep.ts

@@ -1,22 +1,50 @@
 import CONST from '@src/CONST';
 import type {ReimbursementAccountForm} from '@src/types/form';
-import type {CorpayFields} from '@src/types/onyx';
+import type {CorpayFields, CorpayFormField} from '@src/types/onyx';
 import type {SubStepValues} from './getBankInfoStepValues';
 
 /**
  * Returns the initial subStep for the Bank info step based on already existing data
  */
 function getInitialSubStepForBusinessInfoStep(data: SubStepValues<keyof ReimbursementAccountForm>, corpayFields: CorpayFields | undefined): number {
-    const bankAccountDetailsFields = corpayFields?.formFields?.filter((field) => !field.id.includes(CONST.NON_USD_BANK_ACCOUNT.BANK_INFO_STEP_ACCOUNT_HOLDER_KEY_PREFIX));
-    const accountHolderDetailsFields = corpayFields?.formFields?.filter((field) => field.id.includes(CONST.NON_USD_BANK_ACCOUNT.BANK_INFO_STEP_ACCOUNT_HOLDER_KEY_PREFIX));
-    const hasAnyMissingBankAccountDetails = bankAccountDetailsFields?.some((field) => data?.[field.id as keyof ReimbursementAccountForm] === '');
-    const hasAnyMissingAccountHolderDetails = accountHolderDetailsFields?.some((field) => data?.[field.id as keyof ReimbursementAccountForm] === '');
+    if (!corpayFields?.formFields) {
+        return 0;
+    }
+
+    const isFieldInvalidOrMissing = (field: CorpayFormField): boolean => {
+        const fieldID = field.id as keyof ReimbursementAccountForm;
+        const value = data?.[fieldID];
+
+        if (value === '' || value === null || value === undefined) {
+            return true;
+        }
+
+        if (field.validationRules && field.validationRules.length > 0) {
+            const strValue = String(value);
+            return field.validationRules.some((rule) => {
+                if (!rule.regEx) {
+                    return false;
+                }
+
+                const regex = new RegExp(rule.regEx);
+                return !regex.test(strValue);
+            });
+        }
+
+        return false;
+    };
+
+    const bankAccountDetailsFields = corpayFields.formFields.filter((field) => !field.id.includes(CONST.NON_USD_BANK_ACCOUNT.BANK_INFO_STEP_ACCOUNT_HOLDER_KEY_PREFIX));
+    const accountHolderDetailsFields = corpayFields.formFields.filter((field) => field.id.includes(CONST.NON_USD_BANK_ACCOUNT.BANK_INFO_STEP_ACCOUNT_HOLDER_KEY_PREFIX));
+
+    const hasInvalidBankAccountDetails = bankAccountDetailsFields.some(isFieldInvalidOrMissing);
+    const hasInvalidAccountHolderDetails = accountHolderDetailsFields.some(isFieldInvalidOrMissing);
 
-    if (corpayFields === undefined || hasAnyMissingBankAccountDetails) {
+    if (hasInvalidBankAccountDetails) {
         return 0;
     }
 
-    if (hasAnyMissingAccountHolderDetails) {
+    if (hasInvalidAccountHolderDetails) {
         return 1;
     }
 

src/pages/ReimbursementAccount/NonUSD/utils/getInitialSubStepForBusinessInfoStep.ts

@@ -1,41 +1,85 @@
+import {Str} from 'expensify-common';
+import {
+    isValidAddress,
+    isValidCompanyName,
+    isValidEmail,
+    isValidPhoneInternational,
+    isValidRegistrationNumber,
+    isValidTaxIDEINNumber,
+    isValidWebsite,
+    isValidZipCodeInternational,
+} from '@libs/ValidationUtils';
 import CONST from '@src/CONST';
 import INPUT_IDS from '@src/types/form/ReimbursementAccountForm';
 
 const BUSINESS_INFO_STEP_KEYS = INPUT_IDS.ADDITIONAL_DATA.CORPAY;
 
+function isMissingValidCompanyName(companyName: string) {
+    return companyName === '' || !isValidCompanyName(companyName);
+}
+
+function isMissingValidWebsite(website: string) {
+    return website === '' || !isValidWebsite(Str.sanitizeURL(website, CONST.COMPANY_WEBSITE_DEFAULT_SCHEME));
+}
+
+function isMissingValidAddress(street: string, city: string, postalCode: string, state: string, country: string) {
+    return (
+        street === '' ||
+        city === '' ||
+        postalCode === '' ||
+        country === '' ||
+        ((country === CONST.COUNTRY.US || country === CONST.COUNTRY.CA) && state === '') ||
+        (country === '' && state === '') ||
+        !isValidAddress(street) ||
+        (country === CONST.COUNTRY.US && !isValidZipCodeInternational(postalCode))
+    );
+}
+
+function isMissingValidBusinessContactInformation(contactNumber: string, contactEmail: string) {
+    return contactNumber === '' || contactEmail === '' || !isValidPhoneInternational(contactNumber) || !isValidEmail(contactEmail);
+}
+
+function isMissingValidRegistrationNumber(registrationNumber: string, country: string) {
+    return registrationNumber === '' || !isValidRegistrationNumber(registrationNumber, country as keyof typeof CONST.COUNTRY);
+}
+
+function isMissingValidTaxIDEINNumber(taxIDEINNumber: string, country: string) {
+    return taxIDEINNumber === '' || !isValidTaxIDEINNumber(taxIDEINNumber, country as keyof typeof CONST.COUNTRY);
+}
+
 /**
  * Returns the initial subStep for the Business info step based on already existing data
  */
 function getInitialSubStepForBusinessInfoStep(data: Record<string, string>): number {
-    if (data[BUSINESS_INFO_STEP_KEYS.COMPANY_NAME] === '') {
+    if (isMissingValidCompanyName(data[BUSINESS_INFO_STEP_KEYS.COMPANY_NAME])) {
         return 0;
     }
 
-    if (data[BUSINESS_INFO_STEP_KEYS.COMPANY_WEBSITE] === '') {
+    if (isMissingValidWebsite(data[BUSINESS_INFO_STEP_KEYS.COMPANY_WEBSITE])) {
         return 1;
     }
 
     if (
-        data[BUSINESS_INFO_STEP_KEYS.COMPANY_STREET] === '' ||
-        data[BUSINESS_INFO_STEP_KEYS.COMPANY_CITY] === '' ||
-        data[BUSINESS_INFO_STEP_KEYS.COMPANY_POSTAL_CODE] === '' ||
-        data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE] === '' ||
-        ((data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE] === CONST.COUNTRY.US || data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE] === CONST.COUNTRY.CA) &&
-            data[BUSINESS_INFO_STEP_KEYS.COMPANY_STATE] === '') ||
-        (data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE] === '' && data[BUSINESS_INFO_STEP_KEYS.COMPANY_STATE] === '')
+        isMissingValidAddress(
+            data[BUSINESS_INFO_STEP_KEYS.COMPANY_STREET],
+            data[BUSINESS_INFO_STEP_KEYS.COMPANY_CITY],
+            data[BUSINESS_INFO_STEP_KEYS.COMPANY_POSTAL_CODE],
+            data[BUSINESS_INFO_STEP_KEYS.COMPANY_STATE],
+            data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE],
+        )
     ) {
         return 2;
     }
 
-    if (data[BUSINESS_INFO_STEP_KEYS.BUSINESS_CONTACT_NUMBER] === '' || data[BUSINESS_INFO_STEP_KEYS.BUSINESS_CONFIRMATION_EMAIL] === '') {
+    if (isMissingValidBusinessContactInformation(data[BUSINESS_INFO_STEP_KEYS.BUSINESS_CONTACT_NUMBER], data[BUSINESS_INFO_STEP_KEYS.BUSINESS_CONFIRMATION_EMAIL])) {
         return 3;
     }
 
-    if (data[BUSINESS_INFO_STEP_KEYS.BUSINESS_REGISTRATION_INCORPORATION_NUMBER] === '') {
+    if (isMissingValidRegistrationNumber(data[BUSINESS_INFO_STEP_KEYS.BUSINESS_REGISTRATION_INCORPORATION_NUMBER], data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE])) {
         return 4;
     }
 
-    if (data[BUSINESS_INFO_STEP_KEYS.TAX_ID_EIN_NUMBER] === '') {
+    if (isMissingValidTaxIDEINNumber(data[BUSINESS_INFO_STEP_KEYS.TAX_ID_EIN_NUMBER], data[BUSINESS_INFO_STEP_KEYS.COMPANY_COUNTRY_CODE])) {
         return 5;
     }