{"slug": "256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite", "title": "256 Merged PRs in GenOffice: How I Hardened an Open-Source AI Office Suite", "summary": "Developer Aniruddha Adak contributed 256 merged pull requests to genspark-ai/genoffice, an open-source AI office suite, hardening its document parsers against hostile inputs. The patches span Docs, Sheets, Slides, PDF, and the DOCX/PPTX engines, focusing on normalizing non-finite numeric values, malformed XML, and encoding edge cases to prevent renderer denial-of-service and export corruption. Adak advises maintainers of Office parsers to start with hostile-input fuzzing around numbers, quotes, and encodings.", "body_md": "From single-quoted XML quirks to non-finite geometry guards — the story behind 256 merged pull requests in `genspark-ai/genoffice`, the world's first full-featured open-source AI Office suite.\n\nGenOffice is a free, open-source alternative to Microsoft Office (macOS / Windows / Linux). It opens and saves native `.docx`, `.xlsx`, `.pptx`, edits PDF, Markdown and HTML, and puts a reviewable AI agent next to every document. Real formats, byte-preserving. Local by design.\n\nI contributed **256 merged PRs** (PR #187 → #689, plus focused hardening sprints), backed by ~268 commits in my local clone. Almost all are `fix:` / `test:` — small, reviewable, CI-green hardening patches across Docs, Sheets, Slides, PDF, DOCX engine, PPTX engine, xlsx-gateway, html2docx, pdf2docx, shell, CLI, electron-utils, ai-provider, ai-search, and a11y/i18n.\n\nRepo: [https://github.com/genspark-ai/genoffice](https://github.com/genspark-ai/genoffice)\n\nI came for the file-format rabbit hole and stayed for the edge cases. Office files are hostile inputs in the wild: single-quoted attributes, uppercase `True`, paired protection tags, BOM-less UTF-16 CSVs, backslash pptx targets, lowercase xlsx refs, broken slide sizes, 1904 date systems. Each one breaks a naive parser. My loop became: reproduce → clamp/validate/normalize → add regression test → keep the diff minimal.\n\n`fldCharType`, protection attrs, checkbox glyphs, footnote separators, TOC tab stops, `xml:space`, numeric char refs, NBSP edges, paired tags, vanish/footnote bold variants.`true/True` table flags, tab stops as tabs, slides in presentation order.\nA huge slice of the 256 is one pattern: `non-finite in → sane out`. Chart axis min/max, font sizes, ink geometry, connector widths, border widths, rect dims, table colSpan, EQ columns, slide-id scans, CSV row/col caps, bitmap dims, outline JSON caps, SSE buffers, tool-call counts, chat limits, timeline limits, print geometry. Boring? Yes. That's why it matters — one `NaN` can DoS a renderer or corrupt an export.\n\nTraversal-id rejection, canonical path comparison for tabs, renderer file resolution hardening, SSRF `maxRedirects` normalization, MCP host/file checks, sheet-address hardening, zip-handle closing + central-directory validation, protection `spinCount` clamping, lazy-media hash/part-path hardening, redaction-region caps, outline-depth caps, link-rect validation.\n\nBidi direction tests, Southeast Asian + CJK word counts, kana/radical/astral-CJK font mapping, existing i18n keys for aria labels, dialog role/focus/escape, diagram preview keyboard operable, toasts + outline empty-state announcements, localized labels, RTL-aware AI panels.\n\nTouched-blocks coverage, bidi units, east-asian rFonts round-trip, CSV import round-trip, formula-shift + csv-import units, executor/units/op-docs sync, deck-spec + layout-audit, legacy doc/ppt + html2docx tables, CLI help/registry/README/skill sync, xlsx-gateway + pptx-ops wired into CI.\n\n`feat(sheets): infer table range from current region (fixes #298)``feat(pdf): add print range dialog (all/current/custom)`` feat(markdown): add document outline sidebar with click-to-jump``feat(ai-search): add Tavily web search fallback via TAVILY_API_KEY``feat(docs): per-side and inside table borders in ribbon` + RTL-aware panels\nEvery PR below is merged in `genspark-ai/genoffice` by @aniruddhaadak80. Count in this post: **256** (first 300 search results; total is higher — `gh search` caps here).\n\n`NaN`/` Infinity` handling deserves the same discipline as XSS/traversal.\nContinuing the hardening pass (CLI image-size, AI provider media settings, pptx-render SVG flattening were the latest: #689 #687 #684), plus more round-trip tests. If you maintain an Office parser, start with hostile-input fuzzing around numbers, quotes, and encodings — you'll find bugs in an afternoon.\n\n*All PRs merged in [https://github.com/genspark-ai/genoffice](https://github.com/genspark-ai/genoffice) — author: [https://github.com/aniruddhaadak80](https://github.com/aniruddhaadak80)*", "url": "https://wpnews.pro/news/256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite", "canonical_source": "https://dev.to/aniruddhaadak/256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite-5eno", "published_at": "2026-09-22 06:17:14+00:00", "updated_at": "2026-09-22 06:22:41.969226+00:00", "lang": "en", "topics": ["ai-products", "ai-tools", "developer-tools", "ai-agents"], "entities": ["genspark-ai/genoffice", "Aniruddha Adak", "GitHub", "Microsoft Office", "Tavily"], "alternates": {"html": "https://wpnews.pro/news/256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite", "markdown": "https://wpnews.pro/news/256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite.md", "text": "https://wpnews.pro/news/256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite.txt", "jsonld": "https://wpnews.pro/news/256-merged-prs-in-genoffice-how-i-hardened-an-open-source-ai-office-suite.jsonld"}}