Skip to content

TypeScript path alias config parsing should report parse failures and cap JSON depth #3033

Description

@Widthdom

Finding

ParseTypeScriptPathAliasConfig bounds file size and extends depth, but malformed JSON is caught silently and JsonDocument.Parse has no explicit MaxDepth.

Evidence: src/CodeIndex/Indexer/Symbols/SymbolExtractor.TypeScriptPathAliases.cs:95

Risk

A malformed tsconfig.json/jsconfig.json can silently disable path alias resolution, and deeply nested config JSON can spend parser work during indexing.

Suggested fix

Report parse failures through the existing TypeScript path alias warning path and parse with bounded JsonDocumentOptions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecurity

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions