Skip to content

Guard convertToSingleHost against deeply nested JSON config files#504

Merged
millerds merged 1 commit into
OfficeDev:masterfrom
ayush-meghwani-28:user/aymeghwa/harden-convertToSingleHost-deep-json
Jul 6, 2026
Merged

Guard convertToSingleHost against deeply nested JSON config files#504
millerds merged 1 commit into
OfficeDev:masterfrom
ayush-meghwani-28:user/aymeghwa/harden-convertToSingleHost-deep-json

Conversation

@ayush-meghwani-28

@ayush-meghwani-28 ayush-meghwani-28 commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Thank you for your pull request! Please provide the following information.


Change Description:

convertToSingleHost.js reads launch.json / package.json / tasks.json, modifies them, and writes them back with JSON.stringify(content, null, 2). Node's JSON.stringify is recursive, so a config file containing extremely deeply nested JSON causes an opaque "RangeError: Maximum call stack size exceeded" (JSON.parse itself succeeds since it is iterative).

This PR wraps the write-back serialization in a small helper that catches that RangeError and rethrows a clear, actionable message naming the affected file, instead of an opaque stack overflow. Normal template content is unaffected.

  1. Do these changes impact any npm scripts commands (in package.json)? (e.g., running 'npm run start')
    If Yes, briefly describe what is impacted.
    => No

  2. Do these changes impact VS Code debugging options (launch.json)?
    If Yes, briefly describe what is impacted.
    => No

  3. Do these changes impact template output? (e.g., add/remove file, update file location, update file contents)
    If Yes, briefly describe what is impacted.
    => No

  4. Do these changes impact documentation? (e.g., a tutorial on https://docs.microsoft.com/en-us/office/dev/add-ins/overview/office-add-ins)
    If Yes, briefly describe what is impacted.
    => No

If you answered yes to any of these please do the following:
> Include 'Rick-Kirkham' in the review
> Make sure the README file is correct

Validation/testing performed:

  • Ran convertToSingleHost.js against a project whose .vscode/launch.json contained a deeply nested value. Before: crashed with "RangeError: Maximum call stack size exceeded". After: fails with a clear message: 'Unable to update ".vscode/launch.json": its JSON content is too deeply nested.'
  • Verified normal template content converts exactly as before (unchanged output).
  • node --check passes on the modified script

@ayush-meghwani-28 ayush-meghwani-28 requested a review from a team as a code owner July 6, 2026 11:01
@ayush-meghwani-28

Copy link
Copy Markdown
Contributor Author

@ayush-meghwani-28 please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

  • (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
  • (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

@ayush-meghwani-28 ayush-meghwani-28 force-pushed the user/aymeghwa/harden-convertToSingleHost-deep-json branch from 9dd50fe to 2f10b89 Compare July 6, 2026 16:45
@millerds

millerds commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

/azurepipeline run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@millerds

millerds commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Note that this only fixes this one template repo. There are several others (including excel-custom-functions-js, excel-custom-functions-shared*, and office-addin-taskpane* respos).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants