Finding
ParseTypeScriptPathAliasConfig bounds file size and extends depth, but malformed JSON is caught silently and JsonDocument.Parse has no explicit MaxDepth.
Evidence: src/CodeIndex/Indexer/Symbols/SymbolExtractor.TypeScriptPathAliases.cs:95
Risk
A malformed tsconfig.json/jsconfig.json can silently disable path alias resolution, and deeply nested config JSON can spend parser work during indexing.
Suggested fix
Report parse failures through the existing TypeScript path alias warning path and parse with bounded JsonDocumentOptions.
Finding
ParseTypeScriptPathAliasConfigbounds file size and extends depth, but malformed JSON is caught silently andJsonDocument.Parsehas no explicitMaxDepth.Evidence:
src/CodeIndex/Indexer/Symbols/SymbolExtractor.TypeScriptPathAliases.cs:95Risk
A malformed
tsconfig.json/jsconfig.jsoncan silently disable path alias resolution, and deeply nested config JSON can spend parser work during indexing.Suggested fix
Report parse failures through the existing TypeScript path alias warning path and parse with bounded
JsonDocumentOptions.