[Sentry: APP-JSV / APP-JPQ] Dynamic route throws when "action" query param exists in both base path and suffix

[mountiny]

Sentry

• https://expensify.sentry.io/issues/APP-JSV
• https://expensify.sentry.io/issues/APP-JPQ

Both throw the same error from the same frame, on different routes.

Impact (snapshot at filing, 2026-08-17)

Sentry ID	Users (last 14d)	Users (total since first seen)	Events	First seen
APP-JSV	25	25	37	2026-08-04
APP-JPQ	9	9	10	2026-08-10

• Last seen: 2026-08-16 (ongoing)
• Platform: iOS HybridApp (com.expensify.expensifylite); the same throw also reaches web
• App version(s): 9.4.52-11 and later
• Affected view(s): Dynamic_Money_Request_Step_Tag, /search/view/:reportID/expense-report
• Mechanism: onerror, level fatal
• Engine: Hermes, Fabric enabled, RN 0.85.3

Error

Error: [createDynamicRoute] Query param "action" exists in both base path and dynamic suffix. This is not allowed.

Stack trace (top frames)

mergeQueryStrings
createDynamicRoute
onPress
_performTransitionSideEffects
_receiveSignal
onResponderRelease
executeDispatch
executeDispatchesAndReleaseTopLevel
batchedUpdatesImpl
dispatchEvent

Source: src/libs/Navigation/helpers/dynamicRoutesUtils/createDynamicRoute.ts

Suspected cause

createDynamicRoute treats an action query param appearing in both the base path and the dynamic suffix as unrecoverable and throws. On a real navigation that assertion is too strict: the base path already carries ?action=... from the route the user is standing on, and the suffix adds its own, so a plain tap on a money-request step crashes the app instead of navigating.

The fix is likely one of:

1. Let the suffix win and drop the duplicate from the base, rather than throwing.
2. Stop the caller from passing a base path that still carries action — the guard then stays as a genuine invariant.

Option 1 is the safer immediate fix because the throw is fatal on iOS.

Reproduction

Unknown as an exact click path. Both Sentry events fire from an onPress, so the trigger is a user tap and not a deep link. Starting points:

1. Open an expense from Search (/search/view/:reportID/expense-report).
2. Enter a money-request flow that lands on the tag step, on a route that already has an action query param.
3. Tap the control that builds the next dynamic route.

Related

• Sibling Sentry IDs: APP-JSV, APP-JPQ (both covered by this issue)
• Same file, different bug: [Refactor] Extract a shared helper for dynamic-route path joining (root-base slash normalization) #98145 — refactor to share the root-base slash normalization across getPathFromState and createDynamicRoute
• Prior fix in the same area: [NoQA] Fix AI Features Promo modal SecurityError from doubled-slash path and re-entrancy #97849
• Parent tracker: [Tracking] Top Sentry crashes monthly check-in #91302

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022089426056898461330
• Upwork Job ID: 2089426056898461330
• Last Price Increase: 2026-08-17

Issue Owner

Current Issue Owner: @thelullabyy

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @thelullabyy (External)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022089426056898461330

[MelvinBot]

Proposal

What is the root cause of that problem?

createDynamicRoute builds a route by concatenating the current active route (base) with a dynamic suffix and merging their query strings. When the same query key appears in both, mergeQueryStrings throws a fatal error instead of navigating.

On the Tag step this collision is reachable through normal use:

• The tag row's onPress calls createDynamicRoute(MONEY_REQUEST_STEP_TAG.getRoute(action, ...)) with no explicit basePath, so it falls back to Navigation.getActiveRoute(), which includes the current query string.
• The suffix expense-tag?action=… always carries an action query param.
• When the active route is itself a dynamic money-request step already carrying ?action=… (which matches the crashing Sentry view Dynamic_Money_Request_Step_Tag), both base and suffix contain action → the guard throws, level: fatal.

So the guard is treating a normal, recoverable navigation as an unrecoverable invariant violation. It is a design assertion that's too strict, not a recent regression — the throw has existed since the dynamic-routes utils were introduced (PR #87273, Apr 2026).

What changes do you think we should make in order to solve the problem?

Make mergeQueryStrings non-fatal for the duplicate-action case — let the suffix value win and drop the duplicate from the base, rather than throwing. The suffix is the intended destination for the tap, so its params should take precedence. This is the safer immediate fix because the throw crashes the app on iOS. If the invariant is still considered valuable for genuine programming errors, downgrade it to a Log.warn instead of a throw so it never takes down the app.

This mirrors the recoverable-navigation fix approach already used for the same util in PR #97849.

What alternative solutions did you explore? (Optional)

Stop the caller from passing a base path that still carries action: have TagFields pass an explicit basePath (an entry route without ?action=) instead of relying on the getActiveRoute() fallback. This keeps the guard as a genuine invariant, but it only patches this one call site — any other dynamic step reachable while ?action=… is active would still crash, so the util-level fix is more robust.

Investigation details, confidence & repro

Evidence chain (permalinks at ca6b99d):

1. Caller: src/components/MoneyRequestConfirmationList/sections/TagFields.tsx:76 — the only call site of MONEY_REQUEST_STEP_TAG.getRoute, passes no basePath.
2. Suffix builder: src/ROUTES.ts:381-383 — getUrlWithParams('expense-tag', {action, ...}) writes action into the query string.
3. Base retains query: createDynamicRoute.ts:73 falls back to Navigation.getActiveRoute(), which keeps ?… (contrast getActiveRouteWithoutParams).
4. Throw: createDynamicRoute.ts:31 fires when params.has('action') is already true.

Confidence: Medium-high. The caller, route builders, and guard are confirmed in code. The precise runtime state — how the active route is already an expense-tag?action=… step at the moment onPress fires (RHP steps stacking while the confirmation list stays mounted underneath; or a rapid double-tap / re-entrant tap) — is inferred from the Sentry view name and the #97849 re-entrancy precedent, not proven from a trace. Sentry breadcrumbs for APP-JSV / APP-JPQ would confirm the exact sequence and whether it's specific to dependent/multi-level tag policies (which render multiple tag rows).

Related: #98145 (open — refactor the same path-joining code) and PR #97849 (same createDynamicRoute bug class) are worth reading as prior art, but neither is the cause.

---

Next Steps for Contributor+ team:
To accept: @MelvinBot implement [this](https://github.com/Expensify/App/issues/98792) to create a draft PR.
To refine: @MelvinBot <your feedback>
To reject: Explain why you are rejecting Melvin's proposal.

[thelullabyy]

@MelvinBot Please give me patch file to test your proposal

[MelvinBot]

Here's a patch to test the proposal (Option 1 — let the suffix value win instead of throwing). It touches only createDynamicRoute.ts.

Save it as fix-98792.patch at the repo root and apply with git apply fix-98792.patch:

diff --git a/src/libs/Navigation/helpers/dynamicRoutesUtils/createDynamicRoute.ts b/src/libs/Navigation/helpers/dynamicRoutesUtils/createDynamicRoute.ts
index bf2e2b8..686590c 100644
--- a/src/libs/Navigation/helpers/dynamicRoutesUtils/createDynamicRoute.ts
+++ b/src/libs/Navigation/helpers/dynamicRoutesUtils/createDynamicRoute.ts
@@ -7,8 +7,10 @@ import isDynamicRouteSuffix from './isDynamicRouteSuffix';
 import splitPathAndQuery from './splitPathAndQuery';
 
 /**
- * Merges two query strings into one. If both contain the same key,
- * the error is thrown.
+ * Merges two query strings into one. When both contain the same key, the suffix
+ * value wins (it is the intended destination of the navigation) and the duplicate
+ * from the base path is overwritten. A mismatch is logged but never fatal, because
+ * throwing here crashes the app on a legitimate navigation.
  * @param baseQuery - The query string of the base path
  * @param suffixQuery - The query string of the suffix
  * @returns The merged query string or an empty string if both are empty
@@ -16,8 +18,8 @@ import splitPathAndQuery from './splitPathAndQuery';
  * @private - Internal helper. Do not export or use outside this file.
  *
  * @example
- * mergeQueryStrings('foo=bar', 'foo=baz') => '?foo=bar&baz=qux'
- * mergeQueryStrings('foo=bar', 'foo=baz') => throws an error
+ * mergeQueryStrings('foo=bar', 'baz=qux') => '?foo=bar&baz=qux'
+ * mergeQueryStrings('action=edit', 'action=create') => '?action=create' (suffix wins)
  */
 const mergeQueryStrings = (baseQuery = '', suffixQuery = ''): string => {
     if (!baseQuery && !suffixQuery) {
@@ -27,8 +29,12 @@ const mergeQueryStrings = (baseQuery = '', suffixQuery = ''): string => {
     const suffixParams = new URLSearchParams(suffixQuery);
     const suffixParamsEntries = suffixParams.entries();
     for (const [key, value] of suffixParamsEntries) {
-        if (params.has(key)) {
-            throw new Error(`[createDynamicRoute] Query param "${key}" exists in both base path and dynamic suffix. This is not allowed.`);
+        if (params.has(key) && params.get(key) !== value) {
+            Log.warn('[createDynamicRoute.ts] Query param exists in both base path and dynamic suffix with different values; suffix value takes precedence', {
+                key,
+                baseValue: params.get(key),
+                suffixValue: value,
+            });
         }
         params.set(key, value);
     }

What it changes: the duplicate-key guard no longer throws. When the suffix and base carry the same query key, the suffix value overwrites the base value (params.set already does this), and a differing value is logged via Log.warn for visibility instead of crashing. Log is already imported in the file, so no new imports are needed.

How to verify the crash is gone: reproduce a money-request Tag-step tap where the active route already carries ?action=… (per the issue's repro: open an expense from Search → enter a money-request flow → tap a tag row while on a step whose URL has action). Before the patch this throws the fatal [createDynamicRoute] Query param "action" exists in both base path and dynamic suffix error; after it, navigation proceeds and the suffix's action is used.

Note this is an untested patch for your evaluation, not a PR — I haven't run the typecheck/lint/unit suites against it. If you'd like me to open a draft PR (which I'd test before submitting), reply with @MelvinBot implement this.

[mountiny]

@thelullabyy can you please review the proposal?

[thelullabyy]

@mountiny I can confirm the fix works but still find a way to make an actual reproduction instead of enforcing the duplication of action. I will give an update EOD