A script blocked every sublist, not just items

A client script meant to stop customers adding certain items also blocked every other sublist on the order. Here is how we found it and what we changed.

The situation

A client portal limited which items a customer could add to a sales order. Each item carried a list of customer IDs in a custom column, and a client script checked the list when a line was added. We built or worked on the original in SuiteScript 1.0. The client is anonymous.

What we found

We read the original code (inspected). Item 3 is offline-tested.

1. It blocked every sublist. The check only applied to items, but anything else fell through to the “no permission” message. A line on any other sublist could not be added.
2. Spaces broke the match. A list written as “7, 42” did not match customer 42, because the IDs were not trimmed.
3. Multi-select values were probably not read. The original split the list on commas only. A multi-select column may not hand back a plain comma-separated string. We tested the case where values come joined by a hidden separator (U+0005), and the original never matched it. NetSuite’s help for the getCurrentSublistValue method lists “array” among the possible return types. We could not find the U+0005 separator in the NetSuite help we searched (2026-10-31), so treat it as our test case, not a documented fact. The field type of the column in a real account is unknown to us.
4. Errors looked like permission problems. The check’s catch block only wrote to the browser console and then fell through to the same message, so a failure in the check told the user they lacked permission.

What we changed

We rewrote it as a SuiteScript 2.1 client script with a single rule: the order’s customer must be in the item’s list. We kept what was right (an empty list denies, no customer denies, an error denies) and changed three things: only the item sublist is checked, IDs are trimmed, and multi-select values are read whether they arrive as a comma list, a U+0005-joined string or an array.

What the tests show

19 offline tests pass (run 2026-10-31, Node v24.17.0). We also ran 10 synthetic scenarios with invented customers and items:

• 7 behave the same as the original.
• 3 differ on purpose: a list with spaces after commas, a multi-select list, and a non-item sublist.

These tests use mocks. They prove the logic, not deployment, roles or the field type in a real account. NetSuite validation pending.

What NetSuite’s own help adds

None of this was run in a NetSuite account (NetSuite validation pending). These points come from reading the help on 2026-10-31.

• The entry point fits. The help for validateLine says it “checks if a new line is valid before it’s added to an inline editor sublist or editor sublist” and returns true or false, so a false return is the right way to refuse a line.
• The check runs in the browser, in edit mode. The Client Script Type page says client scripts “are executed by predefined event triggers in the client browser” and “only execute when you’re in edit mode”. The page does not mention CSV import or web services, so we treat a bypass by imports and web services as likely, not confirmed. It is why a server-side check may also be needed.
• The alert returns a Promise. dialog.alert returns a Promise, so it does not block the script. Our script returns false straight away and shows the message. The original used the browser’s blocking alert(), so the timing of the message differs.

NetSuite validation pending.

What this means for your scripts

In this script, the rules were in the code, and we found no written record of them in the material we had. Rewriting a script in 2.1 is a good moment to write its rules down as tests. Oracle’s help topic Transitioning to SuiteScript 2.1 says support for SuiteScript 1.0, 2.0 and @NApiVersion 2.0/2.x scripts “is expected to be removed in NetSuite 2028.2”.

Open questions for a real account

• The field type of the customer column, and whether a multi-select arrives as an array or a joined string.
• Whether every path that adds items (UI, copy, line edit) fires the check. The help only says “before it’s added”.
• Whether a server-side check is also needed, since client scripts run in the browser and may be bypassed by imports and web services.
• Who should be exempt.

If you have scripts like this, book a 30-minute script review: calendly.com/byterive/30min

All posts