package.json in user's home dir crashes mac app store packaged app

[kspearrin]

Our app uses electron-store and is distributed on the Mac App Store. We've been getting emails from users that the app crashes whenever a package.json file is in their user home dir (ex. /Users/me/package.json).

To reproduce the problem, all you have to do is create an empty package.json file in your home directory when using the electron app from the Mac App Store (find our's here).

$ touch ~/package.json

Here's the stack trace from the crash when starting the app:

fs.js:142 Uncaught Error: EPERM: operation not permitted, open '/Users/me/package.json'
    at Object.fs.openSync (fs.js:577)
    at Object.module.(anonymous function) [as openSync] (ELECTRON_ASAR.js:166:20)
    at Object.fs.readFileSync (fs.js:483)
    at Object.fs.readFileSync (ELECTRON_ASAR.js:563)
    at new Conf (vendor.js:112295)
    at new ElectronStore (vendor.js:112254)
    at new electronStorage_service_ElectronStorageService (electronStorage.service.ts:21)
    at Module.568 (services.module.ts:87)
    at __webpack_require__ (bootstrap:78)
    at checkDeferredModules (bootstrap:45)

It seems that the "conf" module contains a bug that causes the app to try to locate a "package.json" along the path from the data folder (e.g., "/Users/me/Library/Containers/com.bitwarden.desktop/Data") to the root folder (e.g., "/"). In this case, it does find one— "/Users/me/package.json"— so it fails when it tries to read it even though it isn't suppose to since "cwd" key is provided. Mac App Store apps are sandboxed, to they don't have read access to files outside their container, so it just crashes. This problem doesn't happen with other distribution methods of the app (i.e. dmg file).

I haven't tested it, but this bug might also affect windows store apps as well since they are also sandboxed.

[sindresorhus]

Should be fixed by sindresorhus/conf#62 and available in https://github.com/sindresorhus/electron-store/releases/tag/v3.1.0