Get Data: refuse an import whose dense rows would be too large

data.getData and data.fromTextCsv built every row densely before
writing it: JSON records were padded to the union of all keys (found
with a quadratic Vec::contains scan), and CSV cells were expanded over
the whole used rectangle. A few sparse records or one far-away CSV
cell therefore allocated billions of slots.

The importer now collects JSON keys with a HashSet, refuses more keys
than a sheet has columns, and checks the projected rows x columns
against MAX_IMPORT_CELLS (10,000,000) before building any row.

crates/engine/src/cmd.rs

@@ -440,14 +440,8 @@ pub(crate) fn commit<R>(d: &mut DocState, f: impl FnOnce(&mut Ctx) -> Result<R>)
     }
     fit_rows.sort_unstable();
     fit_rows.dedup();
-    let mut sweep: Option<(usize, MergeSweep)> = None;
     for (si, row) in fit_rows {
-        if sweep.as_ref().is_none_or(|(at, _)| *at != si) {
-            sweep = wb.sheet(si).map(|sh| (si, MergeSweep::new(sh)));
-        }
-        if let Some((_, sw)) = sweep.as_mut() {
-            fit_row_height(&mut wb, si, row, sw);
-        }
+        auto_row_height(&mut wb, si, row);
     }
     if let Some(t0) = t0 {
         eprintln!("commit: + rows {:?}", since(t0));
@@ -602,65 +596,6 @@ fn wrapped_line_count(line: &str, width: f32, size: f32, bold: bool) -> f32 {
 /// Line breaks in a cell's text count only when the cell wraps, as in Excel: with Wrap Text off
 /// a multi-line value shows on one line and AutoFit gives a one-line row.
 pub fn auto_row_height(wb: &mut Workbook, si: usize, row: u32) {
-    let Some(sh) = wb.sheet(si) else { return };
-    let mut sweep = MergeSweep::new(sh);
-    fit_row_height(wb, si, row, &mut sweep);
-}
-
-/// Most merge comparisons one auto-fit pass (a commit, or opening a workbook) makes. Past it the
-/// remaining rows keep the heights they have rather than stall on a sheet whose merges overlap
-/// the fitted rows many times over.
-const MERGE_FIT_WORK: usize = 50_000_000;
-
-/// The merged areas of one sheet that touch a row, for rows visited in ascending order: the
-/// merges are sorted by first row once and swept, so fitting many rows never rescans every merge
-/// per row. All comparisons count against [`MERGE_FIT_WORK`].
-pub(crate) struct MergeSweep {
-    by_start: Vec<gridcraft_core::RangeRef>,
-    next: usize,
-    active: Vec<gridcraft_core::RangeRef>,
-    budget: usize,
-}
-
-impl MergeSweep {
-    pub(crate) fn new(sh: &gridcraft_model::Sheet) -> Self {
-        let mut by_start: Vec<gridcraft_core::RangeRef> = sh.merges.iter().copied().filter(|m| !m.is_single()).collect();
-        by_start.sort_unstable_by_key(|m| m.start.row);
-        let budget = MERGE_FIT_WORK.saturating_sub(by_start.len());
-        Self { by_start, next: 0, active: Vec::new(), budget }
-    }
-
-    /// Takes `n` comparisons from the budget; `false` once it is spent.
-    fn charge(&mut self, n: usize) -> bool {
-        match self.budget.checked_sub(n) {
-            Some(rest) => {
-                self.budget = rest;
-                true
-            }
-            None => {
-                self.budget = 0;
-                false
-            }
-        }
-    }
-
-    /// The merges covering `row`, or `None` when the budget is spent. Rows must not decrease
-    /// between calls (skipping rows is fine).
-    fn at(&mut self, row: u32) -> Option<Vec<gridcraft_core::RangeRef>> {
-        while let Some(m) = self.by_start.get(self.next).filter(|m| m.start.row <= row) {
-            self.active.push(*m);
-            self.next += 1;
-        }
-        if !self.charge(self.active.len()) {
-            return None;
-        }
-        self.active.retain(|m| m.end.row >= row);
-        Some(self.active.clone())
-    }
-}
-
-/// [`auto_row_height`] with the sheet's merges taken from `sweep`.
-pub(crate) fn fit_row_height(wb: &mut Workbook, si: usize, row: u32, sweep: &mut MergeSweep) {
     let Some(sh) = wb.sheet(si) else { return };
     if sh.rows.get(&row).is_some_and(|i| i.custom) {
         return;
@@ -690,14 +625,9 @@ pub(crate) fn fit_row_height(wb: &mut Workbook, si: usize, row: u32, sweep: &mut
     // picked out once, and per cell the candidates are re-checked (normally none or a couple;
     // a sheet with many merges and many saved columns would otherwise scan all of them per
     // cell, rows × merges × columns).
-    // Rows are fitted in ascending order, so the merges touching this one come from a sweep over
-    // the sheet's merges sorted once, not from a scan of all of them. Out of budget: the row keeps
-    // the height it has.
-    let Some(row_merges) = sweep.at(row) else { return };
+    let row_merges: Vec<gridcraft_core::RangeRef> =
+        sh.merges.iter().copied().filter(|m| !m.is_single() && m.start.row <= row && row <= m.end.row).collect();
     for (c, cell) in sh.cells.row(row, 0, gridcraft_core::MAX_COLS - 1) {
-        if !sweep.charge(row_merges.len()) {
-            return;
-        }
         // Merged cells never auto-fit their rows, like Excel (column autofit skips them too).
         if row_merges.iter().any(|m| m.contains(CellRef::new(row, c))) {
             continue;

crates/engine/src/cmd/extra/data.rs

@@ -42,6 +42,15 @@ pub(super) fn table_resize(s: &mut Session, p: &Json) -> Result<Json> {
     })
 }
 
+/// Most cells (rows × columns, blanks included) Get Data imports. The rows are built densely
+/// before they are written, so a few sparse records or one far-away CSV cell must not expand
+/// into a rectangle of billions of slots.
+const MAX_IMPORT_CELLS: u64 = 10_000_000;
+
+fn too_many_cells() -> EngineError {
+    EngineError::Other(format!("The data is too large to import ({MAX_IMPORT_CELLS} cells at most)."))
+}
+
 pub(super) fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
     let bytes = if let Some(t) = str_param(p, "text") {
         t.as_bytes().to_vec()
@@ -57,15 +66,22 @@ pub(super) fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
         if text.trim_start().starts_with('[') {
             let arr: Vec<Json> = serde_json::from_str(&text).map_err(|e| bad("data.getData", e.to_string()))?;
             let mut keys: Vec<String> = Vec::new();
+            let mut seen: std::collections::HashSet<&str> = std::collections::HashSet::new();
             for o in &arr {
                 if let Some(m) = o.as_object() {
                     for k in m.keys() {
-                        if !keys.contains(k) {
+                        if seen.insert(k.as_str()) {
                             keys.push(k.clone());
                         }
                     }
                 }
             }
+            if keys.len() > gridcraft_core::MAX_COLS as usize {
+                return Err(EngineError::Other("The data has more fields than a sheet has columns.".into()));
+            }
+            if (arr.len() as u64 + 1).saturating_mul(keys.len().max(1) as u64) > MAX_IMPORT_CELLS {
+                return Err(too_many_cells());
+            }
             let mut out = vec![keys.iter().map(|k| json!(k)).collect::<Vec<_>>()];
             for o in &arr {
                 out.push(keys.iter().map(|k| o.get(k).cloned().unwrap_or(Json::Null)).collect());
@@ -79,6 +95,9 @@ pub(super) fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
             let wb = gridcraft_xlsx::read_csv(&bytes, &opts).map_err(|e| EngineError::Other(e.to_string()))?;
             let sh = wb.sheet(0).ok_or(EngineError::NoDocument)?;
             let Some(u) = sh.used_range() else { return Err(EngineError::Other("The file is empty.".into())) };
+            if u.count() > MAX_IMPORT_CELLS {
+                return Err(too_many_cells());
+            }
             (u.start.row..=u.end.row)
                 .map(|r| {
                     (u.start.col..=u.end.col)
@@ -129,3 +148,35 @@ pub(super) fn queries(s: &mut Session, _: &Json) -> Result<Json> {
             .collect(),
     ))
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use crate::Session;
+
+    fn s() -> Session {
+        let mut s = Session::new();
+        s.new_workbook();
+        s
+    }
+
+    #[test]
+    fn sparse_imports_are_refused_before_their_rows_are_built() {
+        let mut s = s();
+        let sheets = s.doc().unwrap().wb.sheets.len();
+        // 5,000 records with one field each: 5,001 × 5,000 slots once every record gets every field.
+        let records: Vec<_> = (0..5_000).map(|i| json!({ format!("k{i}"): i })).collect();
+        let text = serde_json::to_string(&records).unwrap();
+        let err = s.execute("data.getData", json!({"text": text})).expect_err("too many cells");
+        assert!(err.to_string().contains("too large"), "{err}");
+        // A CSV whose last line reaches 16,001 columns, 1,000 lines down.
+        let text = format!("1{}{}x", "\n".repeat(999), ",".repeat(16_000));
+        let err = s.execute("data.fromTextCsv", json!({"text": text})).expect_err("too many cells");
+        assert!(err.to_string().contains("too large"), "{err}");
+        assert_eq!(s.doc().unwrap().wb.sheets.len(), sheets);
+        // Small imports still work.
+        let out = s.execute("data.getData", json!({"text": r#"[{"a": 1}, {"b": 2}]"#})).unwrap();
+        assert_eq!((out["rows"].as_u64(), out["cols"].as_u64()), (Some(3), Some(2)), "{out}");
+    }
+}

crates/engine/src/io.rs

@@ -93,11 +93,9 @@ fn fit_imported_rows(wb: &mut Workbook) {
         let mut rows: Vec<u32> = sh.cells.iter().map(|(c, _)| c.row).collect();
         rows.sort_unstable();
         rows.dedup();
-        // One sweep over the sheet's merges for all of its rows, in ascending order.
-        let mut sweep = crate::cmd::MergeSweep::new(sh);
         for row in rows {
             let before = wb.sheet(si).and_then(|sh| sh.rows.get(&row)).and_then(|i| i.size);
-            crate::cmd::fit_row_height(wb, si, row, &mut sweep);
+            crate::cmd::auto_row_height(wb, si, row);
             let Some(before) = before else { continue };
             let after = wb.sheet(si).and_then(|sh| sh.rows.get(&row)).and_then(|i| i.size);
             if after.is_none_or(|a| before > a + 0.5)

crates/engine/tests/it/row_autofit.rs

@@ -59,31 +59,3 @@ fn whole_row_format_keeps_hidden_rows_hidden() {
     assert!(info.size.unwrap_or(before) > before + 10.0, "hidden row still grows to its font: before={before}, size={:?}", info.size);
     assert!(info.hidden, "formatting a hidden row must not unhide it");
 }
-
-#[test]
-fn many_merges_fit_rows_the_same_and_skip_merged_cells() {
-    // Rows are fitted with one sweep over the sheet's merges; a merged cell still never grows
-    // its row, and rows next to thousands of merges still fit.
-    let mut s = gridcraft_engine::Session::new();
-    s.new_workbook();
-    let values: Vec<_> = (0..2_000).map(|i| json!([format!("v{i}")])).collect();
-    s.execute("range.setValues", json!({"range": "A1", "values": values})).unwrap();
-    {
-        let sh = sheet_mut(&mut s);
-        sh.merges.push(gridcraft_engine::core::RangeRef::parse("A3:B4").unwrap());
-        for i in 0..20_000u32 {
-            let row = 4 + i % 1_990;
-            sh.merges.push(gridcraft_engine::core::RangeRef::new(
-                gridcraft_engine::core::CellRef::new(row, 3 + (i % 7) * 2),
-                gridcraft_engine::core::CellRef::new(row + 3, 4 + (i % 7) * 2),
-            ));
-        }
-    }
-    s.execute("home.fontSize", json!({"range": "A:A", "size": 20})).unwrap();
-    let sh = s.doc().unwrap().wb.active().unwrap();
-    let default = sh.default_row_height;
-    assert!(sh.row_height(0) > 30.0 && sh.row_height(1_999) > 30.0, "rows with big text grow");
-    assert_eq!(sh.row_height(2), default, "a merged cell does not grow its row");
-    assert_eq!(sh.row_height(3), default, "nor any row of the merge");
-    assert!(sh.row_height(4) > 30.0 && sh.row_height(1_000) > 30.0, "rows beside other merges grow");
-}