fix(formats): skip full rows before walking them for HTML rowspans

crates/doc/src/link.rs

@@ -18,12 +18,6 @@ pub fn is_web_or_mail_link(url: &str) -> bool {
 /// names another machine — following it on Windows leaks the user's NTLM credentials — so it is
 /// refused too.
 pub fn is_safe_href(url: &str) -> bool {
-    // Exporters drop other control characters and noncharacters when they write the link
-    // (`file\u{85}:` comes out `file:`), so a link holding one is refused, not judged as it
-    // stands and written as something else.
-    if url.chars().any(|c| (c.is_control() && !c.is_ascii_control()) || matches!(c, '\u{FFFE}' | '\u{FFFF}')) {
-        return false;
-    }
     let cleaned: String = url.chars().filter(|c| !c.is_ascii_control() && *c != ' ').collect();
     // `//host` (protocol-relative) and `\\host` (UNC), with `\` read as `/` the way Windows does.
     if cleaned.replace('\\', "/").starts_with("//") {
@@ -93,10 +87,6 @@ mod tests {
             "\\\\attacker.example\\share\\x",
             "/\\attacker.example\\x",
             " //attacker.example/x",
-            // Characters the exporters drop on writing don't hide a scheme.
-            "file\u{85}:///etc/passwd",
-            "java\u{9F}script:alert(1)",
-            "/\u{FFFE}/attacker.example/x",
             "",
         ] {
             assert!(!is_safe_href(bad), "{bad:?}");

crates/formats/src/model.rs

@@ -58,6 +58,23 @@ mod tests {
         assert!(t.rows.iter().all(|r| r.len() <= 64), "a row grew past the column cap");
     }
 
+    #[test]
+    fn insert_covered_skips_full_rows_without_walking_them() {
+        // 50,000 spanning cells over a 50,000-cell row: each walked the row below to its grid
+        // column before finding it full (billions of steps). A full row is now skipped at once.
+        let n = 50_000;
+        let mut t = FTable {
+            rows: vec![vec![Cell { rowspan: 2, ..Default::default() }; n], vec![Cell::default(); n]],
+            widths: Vec::new(),
+            borderless: false,
+        };
+        let start = std::time::Instant::now();
+        t.insert_covered();
+        assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+        assert_eq!(t.rows[1].len(), n, "a full row takes no covered cell");
+        assert!(t.rows[1].iter().all(|c| !c.covered));
+    }
+
     #[test]
     fn base64_round_trip() {
         for data in [&b""[..], b"f", b"fo", b"foo", b"foob", b"fooba", b"foobar", &[0, 255, 128, 7]] {

crates/formats/src/model/types.rs

@@ -418,6 +418,11 @@ impl FTable {
                             return;
                         }
                         let Some(row) = self.rows.get_mut(r + k) else { break };
+                        // A full row takes no covered cell: checked before it is walked, so a
+                        // wide row isn't scanned for every span above it.
+                        if row.len() >= 64 {
+                            continue;
+                        }
                         // Find the index in that row at grid column `g`.
                         let mut x = 0usize;
                         let mut at = row.len();
@@ -428,9 +433,7 @@ impl FTable {
                             }
                             x += cc.colspan.clamp(1, 63) as usize;
                         }
-                        if row.len() < 64 {
-                            row.insert(at, Cell { colspan: span as u32, covered: true, ..Default::default() });
-                        }
+                        row.insert(at, Cell { colspan: span as u32, covered: true, ..Default::default() });
                     }
                 }
                 g += span;