256 Merged PRs in GenOffice: How I Hardened an Open-Source AI Office Suite

Developer Aniruddha Adak contributed 256 merged pull requests to genspark-ai/genoffice, an open-source AI office suite, hardening its document parsers against hostile inputs. The patches span Docs, Sheets, Slides, PDF, and the DOCX/PPTX engines, focusing on normalizing non-finite numeric values, malformed XML, and encoding edge cases to prevent renderer denial-of-service and export corruption. Adak advises maintainers of Office parsers to start with hostile-input fuzzing around numbers, quotes, and encodings.

From single-quoted XML quirks to non-finite geometry guards — the story behind 256 merged pull requests in genspark-ai/genoffice , the world's first full-featured open-source AI Office suite. GenOffice is a free, open-source alternative to Microsoft Office macOS / Windows / Linux . It opens and saves native .docx , .xlsx , .pptx , edits PDF, Markdown and HTML, and puts a reviewable AI agent next to every document. Real formats, byte-preserving. Local by design. I contributed 256 merged PRs PR 187 → 689, plus focused hardening sprints , backed by ~268 commits in my local clone. Almost all are fix: / test: — small, reviewable, CI-green hardening patches across Docs, Sheets, Slides, PDF, DOCX engine, PPTX engine, xlsx-gateway, html2docx, pdf2docx, shell, CLI, electron-utils, ai-provider, ai-search, and a11y/i18n. Repo: https://github.com/genspark-ai/genoffice https://github.com/genspark-ai/genoffice I came for the file-format rabbit hole and stayed for the edge cases. Office files are hostile inputs in the wild: single-quoted attributes, uppercase True , paired protection tags, BOM-less UTF-16 CSVs, backslash pptx targets, lowercase xlsx refs, broken slide sizes, 1904 date systems. Each one breaks a naive parser. My loop became: reproduce → clamp/validate/normalize → add regression test → keep the diff minimal. fldCharType , protection attrs, checkbox glyphs, footnote separators, TOC tab stops, xml:space , numeric char refs, NBSP edges, paired tags, vanish/footnote bold variants. true/True table flags, tab stops as tabs, slides in presentation order. A huge slice of the 256 is one pattern: non-finite in → sane out . Chart axis min/max, font sizes, ink geometry, connector widths, border widths, rect dims, table colSpan, EQ columns, slide-id scans, CSV row/col caps, bitmap dims, outline JSON caps, SSE buffers, tool-call counts, chat limits, timeline limits, print geometry. Boring? Yes. That's why it matters — one NaN can DoS a renderer or corrupt an export. Traversal-id rejection, canonical path comparison for tabs, renderer file resolution hardening, SSRF maxRedirects normalization, MCP host/file checks, sheet-address hardening, zip-handle closing + central-directory validation, protection spinCount clamping, lazy-media hash/part-path hardening, redaction-region caps, outline-depth caps, link-rect validation. Bidi direction tests, Southeast Asian + CJK word counts, kana/radical/astral-CJK font mapping, existing i18n keys for aria labels, dialog role/focus/escape, diagram preview keyboard operable, toasts + outline empty-state announcements, localized labels, RTL-aware AI panels. Touched-blocks coverage, bidi units, east-asian rFonts round-trip, CSV import round-trip, formula-shift + csv-import units, executor/units/op-docs sync, deck-spec + layout-audit, legacy doc/ppt + html2docx tables, CLI help/registry/README/skill sync, xlsx-gateway + pptx-ops wired into CI. feat sheets : infer table range from current region fixes 298 feat pdf : add print range dialog all/current/custom feat markdown : add document outline sidebar with click-to-jump feat ai-search : add Tavily web search fallback via TAVILY API KEY feat docs : per-side and inside table borders in ribbon + RTL-aware panels Every PR below is merged in genspark-ai/genoffice by @aniruddhaadak80. Count in this post: 256 first 300 search results; total is higher — gh search caps here . NaN / Infinity handling deserves the same discipline as XSS/traversal. Continuing the hardening pass CLI image-size, AI provider media settings, pptx-render SVG flattening were the latest: 689 687 684 , plus more round-trip tests. If you maintain an Office parser, start with hostile-input fuzzing around numbers, quotes, and encodings — you'll find bugs in an afternoon. All PRs merged in https://github.com/genspark-ai/genoffice https://github.com/genspark-ai/genoffice — author: https://github.com/aniruddhaadak80 https://github.com/aniruddhaadak80