From e4db0f448ca74bf39798f750aae2b7dae0746d31 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Mon, 2 Nov 2026 20:30:54 -0500 Subject: [PATCH] Find and Replace: bound the text a replacement builds Each occurrence copied the whole replacement string, so a cell full of short matches and a long replacement expanded tens of kilobytes of input into about a gigabyte, in both the case-sensitive and the case-insensitive paths. Replacement now builds the new text only while it stays within Excel's 32,767 characters per cell (counted as UTF-8 bytes, 4 each at most) and within 256 MiB for the whole command, checking before each copy. Past either limit the command fails and changes nothing. --- crates/engine/src/cmd/edit/find.rs | 64 ++++++++++++++++++++++++++--- crates/engine/src/cmd/edit/tests.rs | 30 ++++++++++++++ 2 files changed, 88 insertions(+), 6 deletions(-) diff --git a/crates/engine/src/cmd/edit/find.rs b/crates/engine/src/cmd/edit/find.rs index 0d4656320..f701e4665 100644 --- a/crates/engine/src/cmd/edit/find.rs +++ b/crates/engine/src/cmd/edit/find.rs @@ -104,6 +104,13 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result { Ok(json!({"cell": c.a1(), "sheet": si, "value": t, "count": hits.len()})) } +/// Longest text one replacement may give a cell, in bytes: Excel's 32,767 characters, each up to +/// four bytes. Every occurrence copies the replacement text, so a short cell full of matches and a +/// long replacement would otherwise expand to gigabytes. +const REPLACE_CELL_MAX_BYTES: usize = 32_767 * 4; +/// Most bytes of replaced text one Replace All builds across all its cells. +const REPLACE_TOTAL_MAX_BYTES: usize = 256 * 1024 * 1024; + pub(super) fn replace(s: &mut Session, p: &Json) -> Result { let what = str_param(p, "what").unwrap_or("").to_string(); let with = str_param(p, "with").unwrap_or("").to_string(); @@ -119,6 +126,7 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result { let n = edit(s, |cx| { let sheets: Vec = if workbook { (0..cx.wb.sheets.len()).collect() } else { vec![cx.wb.active_sheet()] }; let mut n = 0; + let mut total = 0usize; for si in sheets { let cells: Vec<(CellRef, String)> = cx.wb.sheet(si).map(|sh| sh.cells.iter().map(|(c, _)| (c, sh.input_text(c))).collect()).unwrap_or_default(); @@ -130,12 +138,19 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result { continue; } let new = if whole { - with.clone() + Some(with.clone()).filter(|w| w.len() <= REPLACE_CELL_MAX_BYTES) } else if case { - text.replace(&what, &with) + replace_cs_within(&text, &what, &with, REPLACE_CELL_MAX_BYTES) } else { - replace_ci(&text, &what, &with) + replace_ci_within(&text, &what, &with, REPLACE_CELL_MAX_BYTES) }; + let Some(new) = new else { + return Err(EngineError::Other(format!("The replacement makes the text of {} too long.", c.a1()))); + }; + total = total.saturating_add(new.len()); + if total > REPLACE_TOTAL_MAX_BYTES { + return Err(EngineError::Other("The replacements make too much text. Replace in a smaller range.".into())); + } // A Python cell's text is its code: the replacement edits the code and the cell // stays a Python cell. Code that would no longer fit in a PY formula is left as it was. let old_py = cx.wb.sheet(si).and_then(|sh| sh.cell(c)).and_then(|x| x.py.clone()); @@ -190,7 +205,37 @@ fn folds_in_place(s: &str) -> bool { }) } +#[cfg(test)] pub(super) fn replace_ci(text: &str, what: &str, with: &str) -> String { + replace_ci_within(text, what, with, usize::MAX).unwrap_or_default() +} + +/// `text` with every `what` replaced by `with`, or `None` once the result passes `limit` bytes +/// (checked before each copy, so nothing larger is allocated). +pub(super) fn replace_cs_within(text: &str, what: &str, with: &str, limit: usize) -> Option { + if what.is_empty() { + return (text.len() <= limit).then(|| text.to_string()); + } + let mut out = String::new(); + let mut i = 0; + for (pos, m) in text.match_indices(what) { + if out.len() + (pos - i) + with.len() > limit { + return None; + } + out.push_str(text.get(i..pos).unwrap_or("")); + out.push_str(with); + i = pos + m.len(); + } + let rest = text.get(i..).unwrap_or(""); + if out.len() + rest.len() > limit { + return None; + } + out.push_str(rest); + Some(out) +} + +/// Case-insensitive [`replace_cs_within`]. +pub(super) fn replace_ci_within(text: &str, what: &str, with: &str, limit: usize) -> Option { let lower = text.to_lowercase(); let w = what.to_lowercase(); // Slicing `text` at positions found in `lower` is only sound when folding kept every byte @@ -198,15 +243,22 @@ pub(super) fn replace_ci(text: &str, what: &str, with: &str) -> String { // boundaries (U+212A KELVIN SIGN shrinks 3→1 bytes, U+0130 grows 2→3), where the tail used // to be dropped. Those fall back to the case-sensitive replace, as length changes already do. if lower.len() != text.len() || w.is_empty() || !folds_in_place(text) || !folds_in_place(what) { - return text.replace(what, with); + return replace_cs_within(text, what, with, limit); } let mut out = String::new(); let mut i = 0; while let Some(pos) = lower.get(i..).and_then(|s| s.find(&w)) { + if out.len() + pos + with.len() > limit { + return None; + } out.push_str(text.get(i..i + pos).unwrap_or("")); out.push_str(with); i += pos + w.len(); } - out.push_str(text.get(i..).unwrap_or("")); - out + let rest = text.get(i..).unwrap_or(""); + if out.len() + rest.len() > limit { + return None; + } + out.push_str(rest); + Some(out) } diff --git a/crates/engine/src/cmd/edit/tests.rs b/crates/engine/src/cmd/edit/tests.rs index 3f3a2fb6d..98bc438e9 100644 --- a/crates/engine/src/cmd/edit/tests.rs +++ b/crates/engine/src/cmd/edit/tests.rs @@ -353,6 +353,36 @@ fn cut_paste_that_overflows_the_grid_moves_nothing() { assert_eq!(get(&mut s, "XFD2")["value"], json!(2.0)); } +#[test] +fn replace_refuses_text_that_would_grow_past_a_cell() { + // 10,000 matches × a 1,000-character replacement would make a 10 MB cell (and a few such + // cells gigabytes); the replacement is refused before that text is built. + let mut s = Session::new(); + s.new_workbook(); + let long = "a".repeat(10_000); + s.execute("range.setValues", json!({"range": "A1", "values": [[long.clone()], ["abc"]]})).unwrap(); + for case in [false, true] { + let err = s.execute("edit.replace", json!({"what": "a", "with": "x".repeat(1_000), "matchCase": case})).expect_err("too long"); + assert!(err.to_string().contains("too long"), "{err}"); + assert_eq!(s.execute("cell.get", json!({"cell": "A1"})).unwrap()["value"], json!(long)); + assert_eq!(s.execute("cell.get", json!({"cell": "A2"})).unwrap()["value"], json!("abc")); + } + // A replacement that stays within a cell's limit still happens. + s.execute("edit.replace", json!({"what": "b", "with": "x".repeat(100)})).unwrap(); + assert_eq!(s.execute("cell.get", json!({"cell": "A2"})).unwrap()["value"], json!(format!("a{}c", "x".repeat(100)))); +} + +#[test] +fn bounded_replace_stops_at_its_limit() { + use super::find::{replace_ci_within, replace_cs_within}; + assert_eq!(replace_cs_within("abab", "a", "xy", 6).as_deref(), Some("xybxyb")); + assert_eq!(replace_cs_within("abab", "a", "xy", 5), None); + assert_eq!(replace_ci_within("AbAb", "a", "xy", 6).as_deref(), Some("xybxyb")); + assert_eq!(replace_ci_within("AbAb", "a", "xy", 5), None); + assert_eq!(replace_cs_within("abc", "z", "", 3).as_deref(), Some("abc")); + assert_eq!(replace_cs_within("abc", "z", "", 2), None); +} + #[test] fn replace_case_insensitive() { assert_eq!(replace_ci("Apple apple APPLE", "apple", "pear"), "pear pear pear");