[Due for payment 2026-11-05] [$175] Expense - Unable to create expense with Parent\\:Child tag, wrong preview on Tag field&table

@bernhardoj

If you haven’t already, check out our contributing guidelines for onboarding. To join our Slack channel, fill out this form.

Version Number: 9.5.20-0
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #104305
Email or phone of affected tester (no customers): [email protected]
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.5 / Chrome
App Component: Money Requests

Action Performed:

Precondition:

Enable Tags.
Create this tag - Parent\:Child

Go to staging.new.expensify.com
Go to workspace chat.
Open FAB > Create expense > Manual.
Create an expense with Parent\:Child tag.
→ Expense cannot be created. Nothing happens after clicking Create expense.
Create two expenses without tag.
Open any expense.
Change the tag to Parent\:Child.
Return to expense report.

Expected Result:

In Step 4, expense can be created with Parent\:Child tag.
In Step 7, Tag field will show Parent\:Child when Parent\:Child tag is selected.
In Step 8, table will show Parent\:Child tag.

Actual Result:

In Step 4, expense cannot be created with Parent\:Child tag. Nothing happens after clicking Create expense..
In Step 7, Tag field shows Parent\when Parent\:Child tag is selected.
In Step 8, Parent\, Child is shown on the table.

Workaround:

Unknown

Platforms:

Screenshots/Videos

Bug7294644_1792778157275.12.mp4

View all open jobs on GitHub

Applause Internal Information
Exported by: Alberto Gutierrez
Bug ID: 7294644

Issue Owner

Current Issue Owner: @bernhardoj

Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~022114957397046533934
Upwork Job ID: 2114957397046533934
Last Price Increase: 2026-10-27

While Applause doesn't embed attachments for this bug, here are the links for quick view:
https://platform.applause.com/services/links/v1/external/3c919e0818052c9a1dca99ca9f96ceb79094c6838cb7be894e32c299df695dbb

@blimpich

@blimpich recently merged #104305, but they are OOO right now, so I'll auto-assign someone else.

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

Identify the pull request that introduced this issue and revert it.
Find someone who can quickly fix the issue.
Fix the issue yourself.

@yuwenmemon

Triggered auto assignment to @yuwenmemon (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

@blimpich

@blimpich @bernhardoj you have been assigned to this deploy blocker because you reviewed the offending PR: #104305

💬 A slack conversation has been started in #expensify-open-source

Deploy Blocker Analysis

Causing PR: Skip already escaped colons when escaping tag names (high confidence). It is on the current staging checklist.

Recommendation: Revert. It is a one-line change in one file plus tests, and nothing depends on it.

Root cause: The PR changed escapeTagName in src/libs/PolicyUtils/tag.ts:271 from replaceAll(':', '\\:') to replaceAll(/(?<!\\):/g, '\\:'). The lookbehind treats any colon after a backslash as already escaped. In Parent\\:Child, though, the backslash before the colon is itself escaped, so the colon is still a level separator. The tag is now saved unescaped and splits into Parent\\ and Child.

Investigation details

How each symptom happens

Production: saves Parent\\\:Child. getTagArrayFromName reads this as one level, so it works.
Staging: saves Parent\\:Child. The same parser reads it as two levels: ['Parent\\', 'Child'].
Create expense does nothing: useConfirmationValidation.ts:273-275 calls hasMatchingTag. Neither split part matches a policy tag, so validation fails with tagOutOfPolicy and submit is blocked. This is the likely mechanism; I didn't confirm how the error shows in the UI.
Tag field shows Parent\\: getTagForDisplay shows only level 0.
Table shows Parent\\, Child: getCommaSeparatedTagNameWithSanitizedColons joins both levels.

Other evidence

The PR review thread raised the \\: case, and the reviewers marked it out of scope. They missed that production already handled it correctly, so leaving it out caused a regression.
The other tag-related PRs on the checklist don't touch tag escaping or parsing. They are Show another user's full unreported expense tag in a single Tag row #104700 (another user's unreported expense tag row), Scan - Unable to create scan expense without merchant in 1:1 chat #103074 (merchant validation), and Add Append custom tag list for accounting-connected workspaces on the indirectTagUploads beta #103359 (multi-level tag import).

Fix-forward option (if re-landing the PR)

Treat a colon as escaped only when an odd number of backslashes comes before it:

function escapeTagName(tag: string) {
    return tag?.replaceAll(/(?<!\\)((?:\\\\)*):/g, '$1\\:');
}

Parent\\:Child becomes Parent\\\:Child, which is one level, as on production.
Parent\:Child stays unchanged, which keeps the PR's fix.
Running it twice gives the same result.

Add Parent\\:Child and a\\\:b cases to the escapeTagName tests in tests/unit/PolicyUtilsTest.ts. I checked these cases by hand and didn't run them.

view run

@bernhardoj

@bernhardoj would you be able to work on this as follow up?

Yes

@MelvinBot

@MelvinBot please implement this

🤖 Draft PR created: Escape tag name colons preceded by an even number of backslashes
Please mark it as "Ready for review" or ask me to do that for you when it is ready for review.

escapeTagName now escapes a colon unless an odd number of backslashes comes before it, so parent\\:child is saved as parent\\\:child and stays one tag level. I added unit tests for the \\: and \\\: cases. The related unit tests, typecheck, lint, and spell check pass. I didn't test it in the UI.

PR is ready
#105102

Job added to Upwork: https://www.upwork.com/jobs/~022114957397046533934

@bernhardoj

@bernhardoj

The solution for this issue has been 🚀 deployed to production 🚀 in version 9.5.24-8 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

Escape tag name colons preceded by an even number of backslashes #105102

If no regressions arise, payment will be issued on 2026-11-05. 🎊

The following checklist (instructions) will need to be completed before the issue can be closed. Please copy/paste the Contributor+ Checklist from here into a new comment on this GH and complete it. If you have the K2 extension, you can simply click: [this button]. If no checklist is needed for this issue, you can click: [no checklist button]

Navigation Menu

Repository navigation

[Due for payment 2026-11-05] [$175] Expense - Unable to create expense with Parent\\:Child tag, wrong preview on Tag field&table #104911

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Deploy Blocker Analysis

6 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Due for payment 2026-11-05] [$175] Expense - Unable to create expense with Parent\\:Child tag, wrong preview on Tag field&table #104911

Description

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Activity

applause-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

github-actions commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

MelvinBot commented on Oct 23, 2026

Deploy Blocker Analysis

6 remaining items

blimpich commented on Oct 26, 2026

bernhardoj commented on Oct 27, 2026

bernhardoj commented on Oct 27, 2026

MelvinBot commented on Oct 27, 2026

bernhardoj commented on Oct 27, 2026

melvin-bot commented on Oct 27, 2026

melvin-bot commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions