Odometer - User can input any character in the Odometer input field

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.31-1
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #78291
Email or phone of affected tester (no customers): applausetester+ds@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 14.5/ Chrome
App Component: Other

Action Performed:

1. Navigate to https://staging.new.expensify.com/
2. Click on the + button > Track Distance
3. Switch to Odometer
4. Write any character on the field

Expected Result:

User is only able to input number

Actual Result:

User can input any character

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7094089_1772660113080.Screen_Recording_2026-03-05_at_12.28.22_at_night.1.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @DylanDylann

[melvin-bot]

You have been assigned to this deploy blocker because you recently merged this PR: #78291

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[melvin-bot]

Triggered auto assignment to @garrettmknight (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

🔍 Investigation Summary

Classification: Frontend bug
Causing PR: #78291 - "Migrate useBeforeRemove to usePreventRemove in DiscardChangesConfirmation" by @mkzie2 (High confidence)
Related Issues: #76326

Recommendation: REVERT

PR #78291 modified IOURequestStepDistanceOdometer.tsx as part of migrating to usePreventRemove. The changes introduced a regression in input validation that allows users to type any character (including letters) in the odometer input fields on web/Chrome.

Labels: This is a frontend bug. Keeping DeployBlockerCash label as appropriate for App deploy blocker.

📋 Detailed Analysis

Evidence

• Issue is reproducible on staging (where PR Migrate useBeforeRemove to usePreventRemove in DiscardChangesConfirmation #78291 is deployed) but not on production
• The issue was first reported linking to PR Migrate useBeforeRemove to usePreventRemove in DiscardChangesConfirmation #78291
• PR Migrate useBeforeRemove to usePreventRemove in DiscardChangesConfirmation #78291 modified src/pages/iou/request/step/IOURequestStepDistanceOdometer.tsx
• The changes affected state management for tracking unsaved changes in the odometer flow

Verification

Files affected by the bug:

• /home/runner/_work/App/App/src/pages/iou/request/step/IOURequestStepDistanceOdometer.tsx (lines 280-323, 520-578)
• /home/runner/_work/App/App/src/libs/DistanceRequestUtils.ts (lines 487-490)

Confirmed that PR #78291 modified IOURequestStepDistanceOdometer.tsx.

Root Cause

The validation logic in isOdometerInputValid() has a flaw where it accepts any input that normalizes to an empty string or NaN:

1. User types a non-numeric character like "a"
2. normalizeOdometerText("a", fromLocaleDigit) strips it to an empty string ""
3. parseFloat("") returns NaN
4. The validation checks !Number.isNaN(value) && value > MAX which is false for NaN
5. The function returns true, allowing the invalid input

The validation should explicitly reject input where:

• The normalized text differs from the original input (indicating non-numeric chars were present)
• The normalized text is empty but the original input was not
• The parsed value is NaN (except for empty string)

On web/Chrome, keyboardType and inputMode only provide UI hints and do not enforce validation, so the isOdometerInputValid function is critical for preventing invalid input.