From b92a1cacf78c0cc7fd394fa70c0c5515c753e010 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20S=C3=BCssemilch?=
 <46485857+misu-dev@users.noreply.github.com>
Date: Mon, 21 Apr 2025 14:28:27 +0200
Subject: [PATCH] fix: commerzbank escape payee (#4845)

---
 .../banks/commerzbank_cobadeff.js             |  5 +++-
 .../banks/tests/commerzbank_cobadeff.spec.js  | 23 +++++++++++++++++++
 .../banks/util/escape-regexp.js               |  4 ++++
 upcoming-release-notes/4845.md                |  6 +++++
 4 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 packages/sync-server/src/app-gocardless/banks/util/escape-regexp.js
 create mode 100644 upcoming-release-notes/4845.md

diff --git a/packages/sync-server/src/app-gocardless/banks/commerzbank_cobadeff.js b/packages/sync-server/src/app-gocardless/banks/commerzbank_cobadeff.js
index e2fe8bc9a2..6fe0e66554 100644
--- a/packages/sync-server/src/app-gocardless/banks/commerzbank_cobadeff.js
+++ b/packages/sync-server/src/app-gocardless/banks/commerzbank_cobadeff.js
@@ -1,4 +1,5 @@
 import Fallback from './integration-bank.js';
+import { escapeRegExp } from './util/escape-regexp.js';
 
 /** @type {import('./bank.interface.js').IBank} */
 export default {
@@ -38,7 +39,9 @@ export default {
     // Clean up remittanceInformation, deduplicate payee (removing slashes ...
     // ... that are added to the remittanceInformation field), and ...
     // ... remove clutter like "End-to-End-Ref.: NOTPROVIDED"
-    const payee = transaction.creditorName || transaction.debtorName || '';
+    const payee = escapeRegExp(
+      transaction.creditorName || transaction.debtorName || '',
+    );
     editedTrans.remittanceInformationUnstructured =
       editedTrans.remittanceInformationUnstructured
         .replace(/\s*(,)?\s+/g, '$1 ')
diff --git a/packages/sync-server/src/app-gocardless/banks/tests/commerzbank_cobadeff.spec.js b/packages/sync-server/src/app-gocardless/banks/tests/commerzbank_cobadeff.spec.js
index fe3a161f68..0485d4017d 100644
--- a/packages/sync-server/src/app-gocardless/banks/tests/commerzbank_cobadeff.spec.js
+++ b/packages/sync-server/src/app-gocardless/banks/tests/commerzbank_cobadeff.spec.js
@@ -106,5 +106,28 @@ describe('CommerzbankCobadeff', () => {
         'CREDITOR00BIC CREDITOR000IBAN DESCRIPTION, Dauerauftrag',
       );
     });
+
+    it('correctly uses regex on payee with special characters', () => {
+      const transaction = {
+        endToEndId: '1234567890',
+        mandateId: '1234567890',
+        bookingDate: '2025-04-18',
+        valueDate: '2025-04-18',
+        transactionAmount: {
+          amount: '-1',
+          currency: 'EUR',
+        },
+        creditorName: 'Netto Marken-Discount Halle (Saale',
+        remittanceInformationUnstructured: 'Example',
+        remittanceInformationUnstructuredArray: ['Example'],
+        remittanceInformationStructured: 'Example',
+        // internalTransactionId: '3815213adb654baeadfb231c853',
+      };
+      const normalizedTransaction = CommerzbankCobadeff.normalizeTransaction(
+        transaction,
+        false,
+      );
+      expect(normalizedTransaction.notes).toEqual('Example');
+    });
   });
 });
diff --git a/packages/sync-server/src/app-gocardless/banks/util/escape-regexp.js b/packages/sync-server/src/app-gocardless/banks/util/escape-regexp.js
new file mode 100644
index 0000000000..1ffd309a12
--- /dev/null
+++ b/packages/sync-server/src/app-gocardless/banks/util/escape-regexp.js
@@ -0,0 +1,4 @@
+// Escape special characters in the string to create a valid regular expression
+export function escapeRegExp(string) {
+  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
diff --git a/upcoming-release-notes/4845.md b/upcoming-release-notes/4845.md
new file mode 100644
index 0000000000..7dd7a33720
--- /dev/null
+++ b/upcoming-release-notes/4845.md
@@ -0,0 +1,6 @@
+---
+category: Bugfix
+authors: [misu-dev]
+---
+
+Escape Payee for Commerzbank RegExp