Skip to content

Guard convertToSingleHost against deeply nested JSON config files#223

Open
ayush-meghwani-28 wants to merge 1 commit into
OfficeDev:masterfrom
ayush-meghwani-28:user/aymeghwa/harden-convertToSingleHost-deep-json
Open

Guard convertToSingleHost against deeply nested JSON config files#223
ayush-meghwani-28 wants to merge 1 commit into
OfficeDev:masterfrom
ayush-meghwani-28:user/aymeghwa/harden-convertToSingleHost-deep-json

Conversation

@ayush-meghwani-28

Copy link
Copy Markdown

Thank you for your pull request! Please provide the following information.


Change Description:

convertToSingleHost.js reads config files (launch.json / package.json / tasks.json), modifies them, and writes them back with JSON.stringify(content, null, 2). Node's JSON.stringify is recursive, so a config file containing extremely deeply nested JSON causes an opaque RangeError: Maximum call stack size exceeded (the earlier JSON.parse succeeds because it is iterative).

This PR wraps the write-back serialization in a small stringifyJson(content, fileName) helper that catches that RangeError and rethrows a clear, actionable message naming the file being written, instead of an opaque stack overflow. Normal template content is unaffected.

This mirrors the fix already merged in OfficeDev/Excel-Custom-Functions#504, applied here because convertToSingleHost.js is duplicated across the template repos.

  1. Do these changes impact any npm scripts commands (in package.json)? (e.g., running 'npm run start')
    => No

  2. Do these changes impact VS Code debugging options (launch.json)?
    => No

  3. Do these changes impact template output? (e.g., add/remove file, update file location, update file contents)
    => No

  4. Do these changes impact documentation? (e.g., a tutorial on https://docs.microsoft.com/en-us/office/dev/add-ins/overview/office-add-ins)
    => No

Validation/testing performed:

  • Ran the modified script's serialization against a config object with a JSON nesting depth of 20000. Before: crashed with "RangeError: Maximum call stack size exceeded". After: fails with a clear message: Unable to update ".vscode/launch.json": its JSON content is too deeply nested.
  • Verified normal config content serializes unchanged.
  • node --check convertToSingleHost.js passes.

convertToSingleHost.js rewrites config files (launch.json / package.json / tasks.json)
by reading, modifying, and writing them back with JSON.stringify. Node's JSON.stringify
is recursive and throws 'RangeError: Maximum call stack size exceeded' on extremely
deeply nested input, producing an opaque failure. Wrap the write-back serialization in a
small helper that catches that RangeError and rethrows a clear message naming the file.
Normal template content is unaffected.
@ayush-meghwani-28 ayush-meghwani-28 requested a review from a team as a code owner July 7, 2026 07:03
@ayush-meghwani-28

Copy link
Copy Markdown
Author

/azurepipeline run

@azure-pipelines

Copy link
Copy Markdown
Commenter does not have sufficient privileges for PR 223 in repo OfficeDev/Office-Addin-TaskPane-JS

@millerds

millerds commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

/azurepipeline run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@millerds

millerds commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

/azurepipeline run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants