Address Copilot review feedback on currency sanitization

- Normalize whitespace + case before validating in sanitizeCurrencyCode
  so common backend malformations like 'eur' and ' USD ' display the
  intended currency instead of incorrectly falling back to USD.
- Throttle the invalid-currency Log.warn to fire at most once per unique
  malformed value using a module-level Set, avoiding log spam on hot
  paths like getLocalizedCurrencySymbol.
- Loosen sanitizeCurrencyCode/isValidCurrencyCode parameter typing to
  unknown so non-string inputs from JS callers are handled safely
  without unsafe-type lint errors.
- Use 'currency' in options (instead of truthiness) in the
  NumberFormatUtils try/catch fallback so Intl.NumberFormat throws
  triggered by an empty-string currency are still recovered to USD.
- Add unit tests for isValidCurrencyCode, sanitizeCurrencyCode, and the
  malformed-currency behavior of convertToDisplayString and
  getLocalizedCurrencySymbol.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: mountiny

src/libs/CurrencyUtils.ts

@@ -24,20 +24,31 @@ Onyx.connect({
  * Returns true when the provided value is a syntactically valid ISO 4217 currency code
  * (exactly 3 uppercase ASCII letters).
  */
-function isValidCurrencyCode(currencyCode: string | undefined | null): currencyCode is string {
+function isValidCurrencyCode(currencyCode: unknown): currencyCode is string {
     return typeof currencyCode === 'string' && /^[A-Z]{3}$/.test(currencyCode);
 }
 
+// Tracks invalid currency codes already warned about so the same bad value doesn't spam the log on every render.
+const warnedInvalidCurrencyCodes = new Set<string>();
+
 /**
  * Validates a currency code and returns it unchanged if it is a valid ISO 4217 code.
- * Returns CONST.CURRENCY.USD and logs a warning when the code is malformed or missing, to prevent Intl.NumberFormat
+ * Whitespace and case-only variations (e.g. " usd ") are normalized rather than discarded.
+ * Returns CONST.CURRENCY.USD and logs a warning at most once per unique malformed value, to prevent Intl.NumberFormat
  * from throwing a RangeError. See https://github.com/Expensify/App/issues/91113
  */
-function sanitizeCurrencyCode(currencyCode: string): string {
+function sanitizeCurrencyCode(currencyCode: unknown): string {
     if (isValidCurrencyCode(currencyCode)) {
         return currencyCode;
     }
-    Log.warn('CurrencyUtils: invalid currency code, defaulting to USD', {currencyCode});
+    const normalized = typeof currencyCode === 'string' ? currencyCode.trim().toUpperCase() : '';
+    if (isValidCurrencyCode(normalized)) {
+        return normalized;
+    }
+    if (!warnedInvalidCurrencyCodes.has(normalized)) {
+        warnedInvalidCurrencyCodes.add(normalized);
+        Log.warn('CurrencyUtils: invalid currency code, defaulting to USD', {currencyCode});
+    }
     return CONST.CURRENCY.USD;
 }
 

src/libs/NumberFormatUtils/index.ts

@@ -13,7 +13,9 @@ function format(locale: Locale | undefined, number: number, options?: Intl.Numbe
     try {
         return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, options).format(number);
     } catch (e) {
-        if (e instanceof RangeError && options?.currency) {
+        // Intl throws RangeError for empty/malformed currency values; check presence of the option (not truthiness)
+        // so we still recover when currency is '' rather than rethrowing and crashing the screen.
+        if (e instanceof RangeError && options && 'currency' in options) {
             Log.warn('NumberFormatUtils: malformed currency code, falling back to USD', {currency: options.currency});
             return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, {...options, currency: CONST.CURRENCY.USD}).format(number);
         }
@@ -25,7 +27,7 @@ function formatToParts(locale: Locale | undefined, number: number, options?: Int
     try {
         return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, options).formatToParts(number);
     } catch (e) {
-        if (e instanceof RangeError && options?.currency) {
+        if (e instanceof RangeError && options && 'currency' in options) {
             Log.warn('NumberFormatUtils: malformed currency code, falling back to USD', {currency: options.currency});
             return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, {...options, currency: CONST.CURRENCY.USD}).formatToParts(number);
         }

tests/unit/CurrencyUtilsTest.ts

@@ -189,4 +189,55 @@ describe('CurrencyUtils', () => {
             IntlStore.load(CONST.LOCALES.ES).then(() => expect(CurrencyUtils.convertToShortDisplayString(amount, currency)).toBe(expectedResult)),
         );
     });
+
+    describe('isValidCurrencyCode', () => {
+        test.each([
+            ['USD', true],
+            ['EUR', true],
+            ['JPY', true],
+            ['', false],
+            ['eur', false],
+            [' USD', false],
+            ['US', false],
+            ['USDX', false],
+            ['US1', false],
+            [undefined, false],
+            [null, false],
+        ])('isValidCurrencyCode(%p) → %p', (input, expected) => {
+            expect(CurrencyUtils.isValidCurrencyCode(input)).toBe(expected);
+        });
+    });
+
+    describe('sanitizeCurrencyCode', () => {
+        test('returns the input unchanged for a valid ISO 4217 code', () => {
+            expect(CurrencyUtils.sanitizeCurrencyCode('EUR')).toBe('EUR');
+        });
+
+        test('normalizes whitespace and case before validating', () => {
+            expect(CurrencyUtils.sanitizeCurrencyCode(' usd ')).toBe('USD');
+            expect(CurrencyUtils.sanitizeCurrencyCode('eur')).toBe('EUR');
+        });
+
+        test.each(['', 'XX', 'USDX', 'US1', '???'])('falls back to USD for malformed input %p', (input) => {
+            expect(CurrencyUtils.sanitizeCurrencyCode(input)).toBe(CONST.CURRENCY.USD);
+        });
+    });
+
+    describe('convertToDisplayString with malformed currency', () => {
+        test.each(['', 'XX', 'USDX', '???'])('does not throw and falls back to USD formatting for %p', (input) => {
+            expect(() => CurrencyUtils.convertToDisplayString(2500, input)).not.toThrow();
+            expect(CurrencyUtils.convertToDisplayString(2500, input)).toBe('$25.00');
+        });
+
+        test('normalizes case-only variations to the intended currency instead of USD', () => {
+            expect(CurrencyUtils.convertToDisplayString(2500, 'eur')).toBe(CurrencyUtils.convertToDisplayString(2500, 'EUR'));
+        });
+    });
+
+    describe('getLocalizedCurrencySymbol with malformed currency', () => {
+        test.each(['', 'XX', 'USDX'])('returns the USD symbol without throwing for %p', (input) => {
+            expect(() => CurrencyUtils.getLocalizedCurrencySymbol(CONST.LOCALES.EN, input)).not.toThrow();
+            expect(CurrencyUtils.getLocalizedCurrencySymbol(CONST.LOCALES.EN, input)).toBe(CurrencyUtils.getLocalizedCurrencySymbol(CONST.LOCALES.EN, CONST.CURRENCY.USD));
+        });
+    });
 });