Get Data: refuse an import whose dense rows would be too large

data.getData and data.fromTextCsv built every row densely before
writing it: JSON records were padded to the union of all keys (found
with a quadratic Vec::contains scan), and CSV cells were expanded over
the whole used rectangle. A few sparse records or one far-away CSV
cell therefore allocated billions of slots.

The importer now collects JSON keys with a HashSet, refuses more keys
than a sheet has columns, and checks the projected rows x columns
against MAX_IMPORT_CELLS (10,000,000) before building any row.

crates/engine/src/cmd/edit/find.rs

@@ -104,13 +104,6 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
     Ok(json!({"cell": c.a1(), "sheet": si, "value": t, "count": hits.len()}))
 }
 
-/// Longest text one replacement may give a cell, in bytes: Excel's 32,767 characters, each up to
-/// four bytes. Every occurrence copies the replacement text, so a short cell full of matches and a
-/// long replacement would otherwise expand to gigabytes.
-const REPLACE_CELL_MAX_BYTES: usize = 32_767 * 4;
-/// Most bytes of replaced text one Replace All builds across all its cells.
-const REPLACE_TOTAL_MAX_BYTES: usize = 256 * 1024 * 1024;
-
 pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
     let what = str_param(p, "what").unwrap_or("").to_string();
     let with = str_param(p, "with").unwrap_or("").to_string();
@@ -126,7 +119,6 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
     let n = edit(s, |cx| {
         let sheets: Vec<usize> = if workbook { (0..cx.wb.sheets.len()).collect() } else { vec![cx.wb.active_sheet()] };
         let mut n = 0;
-        let mut total = 0usize;
         for si in sheets {
             let cells: Vec<(CellRef, String)> =
                 cx.wb.sheet(si).map(|sh| sh.cells.iter().map(|(c, _)| (c, sh.input_text(c))).collect()).unwrap_or_default();
@@ -138,19 +130,12 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
                     continue;
                 }
                 let new = if whole {
-                    Some(with.clone()).filter(|w| w.len() <= REPLACE_CELL_MAX_BYTES)
+                    with.clone()
                 } else if case {
-                    replace_cs_within(&text, &what, &with, REPLACE_CELL_MAX_BYTES)
+                    text.replace(&what, &with)
                 } else {
-                    replace_ci_within(&text, &what, &with, REPLACE_CELL_MAX_BYTES)
+                    replace_ci(&text, &what, &with)
                 };
-                let Some(new) = new else {
-                    return Err(EngineError::Other(format!("The replacement makes the text of {} too long.", c.a1())));
-                };
-                total = total.saturating_add(new.len());
-                if total > REPLACE_TOTAL_MAX_BYTES {
-                    return Err(EngineError::Other("The replacements make too much text. Replace in a smaller range.".into()));
-                }
                 // A Python cell's text is its code: the replacement edits the code and the cell
                 // stays a Python cell. Code that would no longer fit in a PY formula is left as it was.
                 let old_py = cx.wb.sheet(si).and_then(|sh| sh.cell(c)).and_then(|x| x.py.clone());
@@ -205,37 +190,7 @@ fn folds_in_place(s: &str) -> bool {
     })
 }
 
-#[cfg(test)]
 pub(super) fn replace_ci(text: &str, what: &str, with: &str) -> String {
-    replace_ci_within(text, what, with, usize::MAX).unwrap_or_default()
-}
-
-/// `text` with every `what` replaced by `with`, or `None` once the result passes `limit` bytes
-/// (checked before each copy, so nothing larger is allocated).
-pub(super) fn replace_cs_within(text: &str, what: &str, with: &str, limit: usize) -> Option<String> {
-    if what.is_empty() {
-        return (text.len() <= limit).then(|| text.to_string());
-    }
-    let mut out = String::new();
-    let mut i = 0;
-    for (pos, m) in text.match_indices(what) {
-        if out.len() + (pos - i) + with.len() > limit {
-            return None;
-        }
-        out.push_str(text.get(i..pos).unwrap_or(""));
-        out.push_str(with);
-        i = pos + m.len();
-    }
-    let rest = text.get(i..).unwrap_or("");
-    if out.len() + rest.len() > limit {
-        return None;
-    }
-    out.push_str(rest);
-    Some(out)
-}
-
-/// Case-insensitive [`replace_cs_within`].
-pub(super) fn replace_ci_within(text: &str, what: &str, with: &str, limit: usize) -> Option<String> {
     let lower = text.to_lowercase();
     let w = what.to_lowercase();
     // Slicing `text` at positions found in `lower` is only sound when folding kept every byte
@@ -243,22 +198,15 @@ pub(super) fn replace_ci_within(text: &str, what: &str, with: &str, limit: usize
     // boundaries (U+212A KELVIN SIGN shrinks 3→1 bytes, U+0130 grows 2→3), where the tail used
     // to be dropped. Those fall back to the case-sensitive replace, as length changes already do.
     if lower.len() != text.len() || w.is_empty() || !folds_in_place(text) || !folds_in_place(what) {
-        return replace_cs_within(text, what, with, limit);
+        return text.replace(what, with);
     }
     let mut out = String::new();
     let mut i = 0;
     while let Some(pos) = lower.get(i..).and_then(|s| s.find(&w)) {
-        if out.len() + pos + with.len() > limit {
-            return None;
-        }
         out.push_str(text.get(i..i + pos).unwrap_or(""));
         out.push_str(with);
         i += pos + w.len();
     }
-    let rest = text.get(i..).unwrap_or("");
-    if out.len() + rest.len() > limit {
-        return None;
-    }
-    out.push_str(rest);
-    Some(out)
+    out.push_str(text.get(i..).unwrap_or(""));
+    out
 }

crates/engine/src/cmd/edit/tests.rs

@@ -353,36 +353,6 @@ fn cut_paste_that_overflows_the_grid_moves_nothing() {
     assert_eq!(get(&mut s, "XFD2")["value"], json!(2.0));
 }
 
-#[test]
-fn replace_refuses_text_that_would_grow_past_a_cell() {
-    // 10,000 matches × a 1,000-character replacement would make a 10 MB cell (and a few such
-    // cells gigabytes); the replacement is refused before that text is built.
-    let mut s = Session::new();
-    s.new_workbook();
-    let long = "a".repeat(10_000);
-    s.execute("range.setValues", json!({"range": "A1", "values": [[long.clone()], ["abc"]]})).unwrap();
-    for case in [false, true] {
-        let err = s.execute("edit.replace", json!({"what": "a", "with": "x".repeat(1_000), "matchCase": case})).expect_err("too long");
-        assert!(err.to_string().contains("too long"), "{err}");
-        assert_eq!(s.execute("cell.get", json!({"cell": "A1"})).unwrap()["value"], json!(long));
-        assert_eq!(s.execute("cell.get", json!({"cell": "A2"})).unwrap()["value"], json!("abc"));
-    }
-    // A replacement that stays within a cell's limit still happens.
-    s.execute("edit.replace", json!({"what": "b", "with": "x".repeat(100)})).unwrap();
-    assert_eq!(s.execute("cell.get", json!({"cell": "A2"})).unwrap()["value"], json!(format!("a{}c", "x".repeat(100))));
-}
-
-#[test]
-fn bounded_replace_stops_at_its_limit() {
-    use super::find::{replace_ci_within, replace_cs_within};
-    assert_eq!(replace_cs_within("abab", "a", "xy", 6).as_deref(), Some("xybxyb"));
-    assert_eq!(replace_cs_within("abab", "a", "xy", 5), None);
-    assert_eq!(replace_ci_within("AbAb", "a", "xy", 6).as_deref(), Some("xybxyb"));
-    assert_eq!(replace_ci_within("AbAb", "a", "xy", 5), None);
-    assert_eq!(replace_cs_within("abc", "z", "", 3).as_deref(), Some("abc"));
-    assert_eq!(replace_cs_within("abc", "z", "", 2), None);
-}
-
 #[test]
 fn replace_case_insensitive() {
     assert_eq!(replace_ci("Apple apple APPLE", "apple", "pear"), "pear pear pear");

crates/engine/src/cmd/extra/data.rs

@@ -42,6 +42,15 @@ pub(super) fn table_resize(s: &mut Session, p: &Json) -> Result<Json> {
     })
 }
 
+/// Most cells (rows × columns, blanks included) Get Data imports. The rows are built densely
+/// before they are written, so a few sparse records or one far-away CSV cell must not expand
+/// into a rectangle of billions of slots.
+const MAX_IMPORT_CELLS: u64 = 10_000_000;
+
+fn too_many_cells() -> EngineError {
+    EngineError::Other(format!("The data is too large to import ({MAX_IMPORT_CELLS} cells at most)."))
+}
+
 pub(super) fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
     let bytes = if let Some(t) = str_param(p, "text") {
         t.as_bytes().to_vec()
@@ -57,15 +66,22 @@ pub(super) fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
         if text.trim_start().starts_with('[') {
             let arr: Vec<Json> = serde_json::from_str(&text).map_err(|e| bad("data.getData", e.to_string()))?;
             let mut keys: Vec<String> = Vec::new();
+            let mut seen: std::collections::HashSet<&str> = std::collections::HashSet::new();
             for o in &arr {
                 if let Some(m) = o.as_object() {
                     for k in m.keys() {
-                        if !keys.contains(k) {
+                        if seen.insert(k.as_str()) {
                             keys.push(k.clone());
                         }
                     }
                 }
             }
+            if keys.len() > gridcraft_core::MAX_COLS as usize {
+                return Err(EngineError::Other("The data has more fields than a sheet has columns.".into()));
+            }
+            if (arr.len() as u64 + 1).saturating_mul(keys.len().max(1) as u64) > MAX_IMPORT_CELLS {
+                return Err(too_many_cells());
+            }
             let mut out = vec![keys.iter().map(|k| json!(k)).collect::<Vec<_>>()];
             for o in &arr {
                 out.push(keys.iter().map(|k| o.get(k).cloned().unwrap_or(Json::Null)).collect());
@@ -79,6 +95,9 @@ pub(super) fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
             let wb = gridcraft_xlsx::read_csv(&bytes, &opts).map_err(|e| EngineError::Other(e.to_string()))?;
             let sh = wb.sheet(0).ok_or(EngineError::NoDocument)?;
             let Some(u) = sh.used_range() else { return Err(EngineError::Other("The file is empty.".into())) };
+            if u.count() > MAX_IMPORT_CELLS {
+                return Err(too_many_cells());
+            }
             (u.start.row..=u.end.row)
                 .map(|r| {
                     (u.start.col..=u.end.col)
@@ -129,3 +148,35 @@ pub(super) fn queries(s: &mut Session, _: &Json) -> Result<Json> {
             .collect(),
     ))
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use crate::Session;
+
+    fn s() -> Session {
+        let mut s = Session::new();
+        s.new_workbook();
+        s
+    }
+
+    #[test]
+    fn sparse_imports_are_refused_before_their_rows_are_built() {
+        let mut s = s();
+        let sheets = s.doc().unwrap().wb.sheets.len();
+        // 5,000 records with one field each: 5,001 × 5,000 slots once every record gets every field.
+        let records: Vec<_> = (0..5_000).map(|i| json!({ format!("k{i}"): i })).collect();
+        let text = serde_json::to_string(&records).unwrap();
+        let err = s.execute("data.getData", json!({"text": text})).expect_err("too many cells");
+        assert!(err.to_string().contains("too large"), "{err}");
+        // A CSV whose last line reaches 16,001 columns, 1,000 lines down.
+        let text = format!("1{}{}x", "\n".repeat(999), ",".repeat(16_000));
+        let err = s.execute("data.fromTextCsv", json!({"text": text})).expect_err("too many cells");
+        assert!(err.to_string().contains("too large"), "{err}");
+        assert_eq!(s.doc().unwrap().wb.sheets.len(), sheets);
+        // Small imports still work.
+        let out = s.execute("data.getData", json!({"text": r#"[{"a": 1}, {"b": 2}]"#})).unwrap();
+        assert_eq!((out["rows"].as_u64(), out["cols"].as_u64()), (Some(3), Some(2)), "{out}");
+    }
+}