Prevent exotic characters to be input in the account text field

2 files changed, 18 insertions, 2 deletions

diff --git a/ios/MullvadVPN/View controllers/Login/AccountTokenInput.swift b/ios/MullvadVPN/View controllers/Login/AccountTokenInput.swift
index cccc5a1a75..1fef51a479 100644
--- a/ios/MullvadVPN/View controllers/Login/AccountTokenInput.swift
+++ b/ios/MullvadVPN/View controllers/Login/AccountTokenInput.swift
@@ -149,7 +149,13 @@ extension AccountTokenInput: UITextFieldDelegate, UITextPasteDelegate {
         replacementString string: String
     ) -> Bool {
         let emptySelection = textField.selectedTextRange?.isEmpty ?? false
-        let stringRange = Range(range, in: formattedString)!
+
+        // Certain characters such as a backtick can pass through the textField, and appear as an empty string, with a
+        // range outside of the boundaries of the `formattedString`. Such characters are ignored.
+        guard let stringRange = Range(range, in: formattedString) else {
+            updateTextField(textField, notifyDelegate: true)
+            return false
+        }
 
         replaceCharacters(
             in: stringRange,
@@ -177,7 +183,7 @@ extension AccountTokenInput: UITextFieldDelegate, UITextPasteDelegate {
         let length = textField.offset(from: textRange.start, to: textRange.end)
         let nsRange = NSRange(location: location, length: length)
 
-        let stringRange = Range(nsRange, in: formattedString)!
+        guard let stringRange = Range(nsRange, in: formattedString) else { return textRange }
 
         replaceCharacters(
             in: stringRange,
diff --git a/ios/MullvadVPNTests/AccountTokenInputTests.swift b/ios/MullvadVPNTests/AccountTokenInputTests.swift
index 29f232feb3..40933105eb 100644
--- a/ios/MullvadVPNTests/AccountTokenInputTests.swift
+++ b/ios/MullvadVPNTests/AccountTokenInputTests.swift
@@ -90,6 +90,16 @@ class AccountTokenInputTests: XCTestCase {
         XCTAssertEqual(input.formattedString, "1234 0000")
         XCTAssertEqual(input.caretPosition, 9)
     }
+
+    func testInvalidCharactersReplacesTextFieldTextWithFormattedString() {
+        let input = AccountTokenInput(string: kSampleToken)
+        let invalidRange = NSRange(location: 5, length: 0)
+        let textField = UITextField()
+
+        _ = input.textField(textField, shouldChangeCharactersIn: invalidRange, replacementString: "")
+
+        XCTAssertEqual(textField.text, input.formattedString)
+    }
 }
 
 private extension String {