From single-quoted XML quirks to non-finite geometry guards — the story behind 256 merged pull requests in genspark-ai/genoffice, the world's first full-featured open-source AI Office suite.
GenOffice is a free, open-source alternative to Microsoft Office (macOS / Windows / Linux). It opens and saves native .docx, .xlsx, .pptx, edits PDF, Markdown and HTML, and puts a reviewable AI agent next to every document. Real formats, byte-preserving. Local by design.
I contributed 256 merged PRs (PR #187 → #689, plus focused hardening sprints), backed by ~268 commits in my local clone. Almost all are fix: / test: — small, reviewable, CI-green hardening patches across Docs, Sheets, Slides, PDF, DOCX engine, PPTX engine, xlsx-gateway, html2docx, pdf2docx, shell, CLI, electron-utils, ai-provider, ai-search, and a11y/i18n.
Repo: https://github.com/genspark-ai/genoffice
I came for the file-format rabbit hole and stayed for the edge cases. Office files are hostile inputs in the wild: single-quoted attributes, uppercase True, paired protection tags, BOM-less UTF-16 CSVs, backslash pptx targets, lowercase xlsx refs, broken slide sizes, 1904 date systems. Each one breaks a naive parser. My loop became: reproduce → clamp/validate/normalize → add regression test → keep the diff minimal.
fldCharType, protection attrs, checkbox glyphs, footnote separators, TOC tab stops, xml:space, numeric char refs, NBSP edges, paired tags, vanish/footnote bold variants.true/True table flags, tab stops as tabs, slides in presentation order.
A huge slice of the 256 is one pattern: non-finite in → sane out. Chart axis min/max, font sizes, ink geometry, connector widths, border widths, rect dims, table colSpan, EQ columns, slide-id scans, CSV row/col caps, bitmap dims, outline JSON caps, SSE buffers, tool-call counts, chat limits, timeline limits, print geometry. Boring? Yes. That's why it matters — one NaN can DoS a renderer or corrupt an export.
Traversal-id rejection, canonical path comparison for tabs, renderer file resolution hardening, SSRF maxRedirects normalization, MCP host/file checks, sheet-address hardening, zip-handle closing + central-directory validation, protection spinCount clamping, lazy-media hash/part-path hardening, redaction-region caps, outline-depth caps, link-rect validation.
Bidi direction tests, Southeast Asian + CJK word counts, kana/radical/astral-CJK font mapping, existing i18n keys for aria labels, dialog role/focus/escape, diagram preview keyboard operable, toasts + outline empty-state announcements, localized labels, RTL-aware AI panels.
Touched-blocks coverage, bidi units, east-asian rFonts round-trip, CSV import round-trip, formula-shift + csv-import units, executor/units/op-docs sync, deck-spec + layout-audit, legacy doc/ppt + html2docx tables, CLI help/registry/README/skill sync, xlsx-gateway + pptx-ops wired into CI.
feat(sheets): infer table range from current region (fixes #298)``feat(pdf): add print range dialog (all/current/custom)`` feat(markdown): add document outline sidebar with click-to-jump``feat(ai-search): add Tavily web search fallback via TAVILY_API_KEY``feat(docs): per-side and inside table borders in ribbon + RTL-aware panels
Every PR below is merged in genspark-ai/genoffice by @aniruddhaadak80. Count in this post: 256 (first 300 search results; total is higher — gh search caps here).
NaN/ Infinity handling deserves the same discipline as XSS/traversal.
Continuing the hardening pass (CLI image-size, AI provider media settings, pptx-render SVG flattening were the latest: #689 #687 #684), plus more round-trip tests. If you maintain an Office parser, start with hostile-input fuzzing around numbers, quotes, and encodings — you'll find bugs in an afternoon.
All PRs merged in https://github.com/genspark-ai/genoffice — author: https://github.com/aniruddhaadak80