fix(doc): refuse export links holding characters the writers drop

crates/doc/src/link.rs

@@ -18,6 +18,12 @@ pub fn is_web_or_mail_link(url: &str) -> bool {
 /// names another machine — following it on Windows leaks the user's NTLM credentials — so it is
 /// refused too.
 pub fn is_safe_href(url: &str) -> bool {
+    // Exporters drop other control characters and noncharacters when they write the link
+    // (`file\u{85}:` comes out `file:`), so a link holding one is refused, not judged as it
+    // stands and written as something else.
+    if url.chars().any(|c| (c.is_control() && !c.is_ascii_control()) || matches!(c, '\u{FFFE}' | '\u{FFFF}')) {
+        return false;
+    }
     let cleaned: String = url.chars().filter(|c| !c.is_ascii_control() && *c != ' ').collect();
     // `//host` (protocol-relative) and `\\host` (UNC), with `\` read as `/` the way Windows does.
     if cleaned.replace('\\', "/").starts_with("//") {
@@ -87,6 +93,10 @@ mod tests {
             "\\\\attacker.example\\share\\x",
             "/\\attacker.example\\x",
             " //attacker.example/x",
+            // Characters the exporters drop on writing don't hide a scheme.
+            "file\u{85}:///etc/passwd",
+            "java\u{9F}script:alert(1)",
+            "/\u{FFFE}/attacker.example/x",
             "",
         ] {
             assert!(!is_safe_href(bad), "{bad:?}");

crates/formats/src/model.rs

@@ -58,23 +58,6 @@ mod tests {
         assert!(t.rows.iter().all(|r| r.len() <= 64), "a row grew past the column cap");
     }
 
-    #[test]
-    fn insert_covered_skips_full_rows_without_walking_them() {
-        // 50,000 spanning cells over a 50,000-cell row: each walked the row below to its grid
-        // column before finding it full (billions of steps). A full row is now skipped at once.
-        let n = 50_000;
-        let mut t = FTable {
-            rows: vec![vec![Cell { rowspan: 2, ..Default::default() }; n], vec![Cell::default(); n]],
-            widths: Vec::new(),
-            borderless: false,
-        };
-        let start = std::time::Instant::now();
-        t.insert_covered();
-        assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
-        assert_eq!(t.rows[1].len(), n, "a full row takes no covered cell");
-        assert!(t.rows[1].iter().all(|c| !c.covered));
-    }
-
     #[test]
     fn base64_round_trip() {
         for data in [&b""[..], b"f", b"fo", b"foo", b"foob", b"fooba", b"foobar", &[0, 255, 128, 7]] {

crates/formats/src/model/types.rs

@@ -418,11 +418,6 @@ impl FTable {
                             return;
                         }
                         let Some(row) = self.rows.get_mut(r + k) else { break };
-                        // A full row takes no covered cell: checked before it is walked, so a
-                        // wide row isn't scanned for every span above it.
-                        if row.len() >= 64 {
-                            continue;
-                        }
                         // Find the index in that row at grid column `g`.
                         let mut x = 0usize;
                         let mut at = row.len();
@@ -433,7 +428,9 @@ impl FTable {
                             }
                             x += cc.colspan.clamp(1, 63) as usize;
                         }
-                        row.insert(at, Cell { colspan: span as u32, covered: true, ..Default::default() });
+                        if row.len() < 64 {
+                            row.insert(at, Cell { colspan: span as u32, covered: true, ..Default::default() });
+                        }
                     }
                 }
                 g += span;