LHN - Self DM preview show HTML tags when description has mark down after removing from report

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.7-1
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #78634
Email or phone of affected tester (no customers): sodijnsodinjisojisoji@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.1 / Chrome
App Component: Money Requests

Action Performed:

1. Go to staging.new.expensify.com
2. Go to workspace chat.
3. Create an expense with google.com as description and any merchant.
4. Open the expense report.
5. Click Report field > Remove from report.
6. Check self DM preview on LHN.

Expected Result:

Self DM preview will not show HTML tags.

Actual Result:

Self DM preview show HTML tags when description has mark down.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

[melvin-bot]

You have been assigned to this deploy blocker because you recently merged this PR: #78634

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[melvin-bot]

Triggered auto assignment to @CortneyOfstad (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Frontend bug
Causing PR: #78634 - "new Onyx Derived Value VISIBLE_REPORT_ACTIONS" by @BartekObudzinski (High confidence)
Related Issues: None

Recommendation: REVERT

PR #78634 introduced a new derived value system for determining visible report actions. This change modified how the last visible action is determined in the LHN, which caused UNREPORTED_TRANSACTION actions to be displayed as the last action when an expense is removed from a report.

The issue is that getUnreportedTransactionMessage() uses getReportName() which can return HTML-formatted text when the report name contains markdown (like "google.com" in the description). This HTML report name is then embedded into another HTML template string (the translation for iou.movedTransactionFrom), creating nested HTML like:

moved this expense from <a href="reportUrl"><a href="http://google.com" target="_blank">google.com</a></a>

When Parser.htmlToText() is called on this nested HTML, it does not properly strip all HTML tags, causing raw HTML to appear in the LHN preview.

Note: There is a TODO comment in the code (line 7021 of ReportUtils.ts) acknowledging this issue and referencing PR #75357 as a follow-up fix, but PR #78634 made this latent bug visible by changing which actions are displayed in the LHN.

Labels: Keeping DeployBlockerCash label as this is a Frontend bug requiring an App PR fix/revert.

Detailed Analysis

Evidence

1. The issue mentions PR new Onyx Derived Value VISIBLE_REPORT_ACTIONS #78634 in the issue body, and melvin-bot assigned the PR author
2. PR new Onyx Derived Value VISIBLE_REPORT_ACTIONS #78634 introduced VISIBLE_REPORT_ACTIONS derived value and changed how last visible actions are calculated
3. The bug appears when removing an expense with a markdown description from a report, which creates an UNREPORTED_TRANSACTION action
4. This action type uses getUnreportedTransactionMessage() which has a known issue with HTML in report names

Verification

• Affected files:

  • /home/runner/work/App/App/src/libs/ReportUtils.ts (line 7015-7040) - getUnreportedTransactionMessage() function
  • /home/runner/work/App/App/src/libs/OptionsListUtils/index.ts (line 795-796) - calls Parser.htmlToText(getUnreportedTransactionMessage(lastReportAction))
  • /home/runner/work/App/App/src/languages/en.ts (line 1136-1137) - translation strings with HTML templates

• PR new Onyx Derived Value VISIBLE_REPORT_ACTIONS #78634 modified:

  • src/libs/actions/OnyxDerived/configs/visibleReportActions.ts (new file, 136 lines)
  • src/libs/ReportActionsUtils.ts (120 additions)
  • src/libs/OptionsListUtils/index.ts (148 additions, 80 deletions)
  • src/components/LHNOptionsList/LHNOptionsList.tsx (43 additions, 43 deletions)

Root Cause

PR #78634 changed the visibility logic for report actions through a derived value system. This caused a change in which action is selected as the "last visible action" for display in the LHN. Specifically, UNREPORTED_TRANSACTION actions are now more likely to be displayed as the last action after removing an expense from a report.

When these actions are displayed, the getUnreportedTransactionMessage() function embeds the report name (which may contain HTML from markdown processing) into an HTML template string without proper escaping. The nested HTML structure is not fully stripped by Parser.htmlToText(), causing raw HTML tags to appear in the LHN preview.

The underlying issue of HTML in report names existed before PR #78634, but the PR made it visible by changing the action selection logic.