Gracefully handle malformed currency codes instead of crashing

When a workspace policy or transaction has an invalid currency code stored in
the backend, Intl.NumberFormat throws a RangeError that crashes the expense
amount screen. Add two-layer protection:

1. sanitizeCurrencyCode helper in CurrencyUtils.ts: validates the format
   (ISO 4217 = exactly 3 uppercase ASCII letters) and falls back to USD with
   a Log.warn when the code is malformed. Applied in getLocalizedCurrencySymbol,
   convertToDisplayString, convertToDisplayStringWithoutCurrency,
   convertToShortDisplayString, and convertAmountToDisplayString.

2. try/catch safety net in NumberFormatUtils/index.ts: catches any RangeError
   from Intl.NumberFormat caused by a bad currency option that slips past
   layer 1, retries with USD, and logs a warning.

Also sanitizes currency in TotalCell.tsx before its direct formatToParts call.

Fixes Expensify#91113

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: mountiny

src/components/TransactionItemRow/DataCells/TotalCell.tsx

@@ -8,7 +8,7 @@ import {useCurrencyListActions} from '@hooks/useCurrencyList';
 import useKeyboardShortcut from '@hooks/useKeyboardShortcut';
 import useLocalize from '@hooks/useLocalize';
 import useThemeStyles from '@hooks/useThemeStyles';
-import {convertToBackendAmount, convertToFrontendAmountAsString, getCurrencyDecimals} from '@libs/CurrencyUtils';
+import {convertToBackendAmount, convertToFrontendAmountAsString, getCurrencyDecimals, sanitizeCurrencyCode} from '@libs/CurrencyUtils';
 import {formatToParts} from '@libs/NumberFormatUtils';
 import {parseFloatAnyLocale, roundToTwoDecimalPlaces} from '@libs/NumberUtils';
 import {getTransactionDetails, isInvoiceReport, shouldEnableNegative} from '@libs/ReportUtils';
@@ -121,10 +121,11 @@ function TotalCell({shouldShowTooltip, transactionItem, canEdit, onSave, report,
     // Some currencies display with a space between symbol and amount (e.g., "CZK 100.00") in convertToDisplayString (in preview).
     // We detect this spacing and apply matching padding to the input to prevent visual flicker when entering edit mode.
     // See: https://github.com/Expensify/App/pull/83127#issuecomment-4240055145
+    const sanitizedCurrency = sanitizeCurrencyCode(currency);
     const hasSymbolSpaceInPreview = formatToParts(preferredLocale, 0, {
         style: 'currency',
-        currency,
-        minimumFractionDigits: getCurrencyDecimals(currency),
+        currency: sanitizedCurrency,
+        minimumFractionDigits: getCurrencyDecimals(sanitizedCurrency),
         maximumFractionDigits: CONST.DEFAULT_CURRENCY_DECIMALS,
     }).some((part) => part.type === 'literal' && part.value.trim() === '');
 

src/libs/CurrencyUtils.ts

@@ -1,6 +1,7 @@
 import Onyx from 'react-native-onyx';
 import CONST from '@src/CONST';
 import IntlStore from '@src/languages/IntlStore';
+import Log from '@src/libs/Log';
 import type {OnyxValues} from '@src/ONYXKEYS';
 import ONYXKEYS from '@src/ONYXKEYS';
 import type {Locale} from '@src/types/onyx';
@@ -19,6 +20,19 @@ Onyx.connect({
     },
 });
 
+/**
+ * Validates a currency code and returns it unchanged if it is a valid ISO 4217 code (exactly 3 uppercase ASCII letters).
+ * Returns CONST.CURRENCY.USD and logs a warning when the code is malformed or missing, to prevent Intl.NumberFormat
+ * from throwing a RangeError. See https://github.com/Expensify/App/issues/91113
+ */
+function sanitizeCurrencyCode(currencyCode: string): string {
+    if (/^[A-Z]{3}$/.test(currencyCode)) {
+        return currencyCode;
+    }
+    Log.warn('CurrencyUtils: invalid currency code, defaulting to USD', {currencyCode});
+    return CONST.CURRENCY.USD;
+}
+
 /**
  * Returns the number of digits after the decimal separator for a specific currency.
  * For currencies that have decimal places > 2, floor to 2 instead:
@@ -47,7 +61,7 @@ function getCurrencyUnit(currency: string = CONST.CURRENCY.USD): number {
 function getLocalizedCurrencySymbol(locale: Locale | undefined, currencyCode: string): string | undefined {
     const parts = formatToParts(locale, 0, {
         style: 'currency',
-        currency: currencyCode,
+        currency: sanitizeCurrencyCode(currencyCode),
     });
     return parts.find((part) => part.type === 'currency')?.value;
 }
@@ -97,15 +111,9 @@ function convertToFrontendAmountAsString(amountAsInt: number | null | undefined,
  * @param currency - IOU currency
  */
 function convertToDisplayString(amountInCents = 0, currency: string = CONST.CURRENCY.USD, shouldUseLocalCurrencySymbol = false): string {
-    const decimals = getCurrencyDecimals(currency);
+    const currencyWithFallback = sanitizeCurrencyCode(currency);
+    const decimals = getCurrencyDecimals(currencyWithFallback);
     const convertedAmount = convertToFrontendAmountAsInteger(amountInCents, decimals);
-    /**
-     * Fallback currency to USD if it empty string or undefined
-     */
-    let currencyWithFallback = currency;
-    if (!currency) {
-        currencyWithFallback = CONST.CURRENCY.USD;
-    }
 
     if (shouldUseLocalCurrencySymbol) {
         const currencySymbol = getCurrencySymbol(currencyWithFallback);
@@ -153,7 +161,7 @@ function convertToShortDisplayString(amountInCents = 0, currency: string = CONST
 
     return format(IntlStore.getCurrentLocale(), convertedAmount, {
         style: 'currency',
-        currency,
+        currency: sanitizeCurrencyCode(currency),
 
         // There will be no decimals displayed (e.g. $9)
         minimumFractionDigits: 0,
@@ -171,7 +179,7 @@ function convertAmountToDisplayString(amount = 0, currency: string = CONST.CURRE
     const convertedAmount = amount / 100.0;
     return format(IntlStore.getCurrentLocale(), convertedAmount, {
         style: 'currency',
-        currency,
+        currency: sanitizeCurrencyCode(currency),
         minimumFractionDigits: CONST.MIN_TAX_RATE_DECIMAL_PLACES,
         maximumFractionDigits: CONST.MAX_TAX_RATE_DECIMAL_PLACES,
     });
@@ -181,11 +189,12 @@ function convertAmountToDisplayString(amount = 0, currency: string = CONST.CURRE
  * Acts the same as `convertAmountToDisplayString` but the result string does not contain currency
  */
 function convertToDisplayStringWithoutCurrency(amountInCents: number, currency: string = CONST.CURRENCY.USD) {
-    const decimals = getCurrencyDecimals(currency);
+    const sanitizedCurrency = sanitizeCurrencyCode(currency);
+    const decimals = getCurrencyDecimals(sanitizedCurrency);
     const convertedAmount = convertToFrontendAmountAsInteger(amountInCents, decimals);
     return formatToParts(IntlStore.getCurrentLocale(), convertedAmount, {
         style: 'currency',
-        currency,
+        currency: sanitizedCurrency,
 
         // We are forcing the number of decimals because we override the default number of decimals in the backend for some currencies
         // See: https://github.com/Expensify/PHP-Libs/pull/834
@@ -200,6 +209,7 @@ function convertToDisplayStringWithoutCurrency(amountInCents: number, currency:
 }
 
 export {
+    sanitizeCurrencyCode,
     getCurrencyDecimals,
     getCurrencyUnit,
     getLocalizedCurrencySymbol,

src/libs/NumberFormatUtils/index.ts

@@ -1,6 +1,7 @@
 import intlPolyfill from '@libs/IntlPolyfill';
 import memoize from '@libs/memoize';
 import CONST from '@src/CONST';
+import Log from '@src/libs/Log';
 import type Locale from '@src/types/onyx/Locale';
 
 // Polyfill the Intl API if locale data is not as expected
@@ -9,11 +10,27 @@ intlPolyfill();
 const MemoizedNumberFormat = memoize(Intl.NumberFormat, {maxSize: 10, monitoringName: 'NumberFormatUtils'});
 
 function format(locale: Locale | undefined, number: number, options?: Intl.NumberFormatOptions): string {
-    return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, options).format(number);
+    try {
+        return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, options).format(number);
+    } catch (e) {
+        if (e instanceof RangeError && options?.currency) {
+            Log.warn('NumberFormatUtils: malformed currency code, falling back to USD', {currency: options.currency});
+            return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, {...options, currency: CONST.CURRENCY.USD}).format(number);
+        }
+        throw e;
+    }
 }
 
 function formatToParts(locale: Locale | undefined, number: number, options?: Intl.NumberFormatOptions): Intl.NumberFormatPart[] {
-    return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, options).formatToParts(number);
+    try {
+        return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, options).formatToParts(number);
+    } catch (e) {
+        if (e instanceof RangeError && options?.currency) {
+            Log.warn('NumberFormatUtils: malformed currency code, falling back to USD', {currency: options.currency});
+            return new MemoizedNumberFormat(locale ?? CONST.LOCALES.DEFAULT, {...options, currency: CONST.CURRENCY.USD}).formatToParts(number);
+        }
+        throw e;
+    }
 }
 
 export {format, formatToParts};