fix(formats): build at most MAX_COLS cells per Markdown table row

crates/doc/src/link.rs

@@ -18,12 +18,6 @@ pub fn is_web_or_mail_link(url: &str) -> bool {
 /// names another machine — following it on Windows leaks the user's NTLM credentials — so it is
 /// refused too.
 pub fn is_safe_href(url: &str) -> bool {
-    // Exporters drop other control characters and noncharacters when they write the link
-    // (`file\u{85}:` comes out `file:`), so a link holding one is refused, not judged as it
-    // stands and written as something else.
-    if url.chars().any(|c| (c.is_control() && !c.is_ascii_control()) || matches!(c, '\u{FFFE}' | '\u{FFFF}')) {
-        return false;
-    }
     let cleaned: String = url.chars().filter(|c| !c.is_ascii_control() && *c != ' ').collect();
     // `//host` (protocol-relative) and `\\host` (UNC), with `\` read as `/` the way Windows does.
     if cleaned.replace('\\', "/").starts_with("//") {
@@ -93,10 +87,6 @@ mod tests {
             "\\\\attacker.example\\share\\x",
             "/\\attacker.example\\x",
             " //attacker.example/x",
-            // Characters the exporters drop on writing don't hide a scheme.
-            "file\u{85}:///etc/passwd",
-            "java\u{9F}script:alert(1)",
-            "/\u{FFFE}/attacker.example/x",
             "",
         ] {
             assert!(!is_safe_href(bad), "{bad:?}");

crates/formats/src/markdown/blocks.rs

@@ -474,14 +474,17 @@ fn parse_blocks(lines: &[String], depth: usize, level: u8, refs: &Refs) -> Vec<F
                     let p = Para { align: a, inlines: parse_inlines(s, &Fmt::default(), depth, refs), ..Default::default() };
                     Cell { blocks: vec![FBlock::Para(p)], header, ..Default::default() }
                 };
-                table.rows.push(head.iter().zip(&aligns).map(|(s, a)| cell(s, true, *a)).collect());
+                // A document row keeps MAX_COLS cells: only those are built, so a wide header
+                // doesn't pad every sparse row below it out to its width.
+                let cols = aligns.len().min(wordcraft_doc::table::MAX_COLS);
+                table.rows.push(head.iter().zip(&aligns).take(cols).map(|(s, a)| cell(s, true, *a)).collect());
                 i += 2;
                 while let Some(l) = lines.get(i) {
                     if is_blank(l) || !l.contains('|') || interrupts(l) {
                         break;
                     }
                     let mut cells = split_row(l);
-                    cells.resize(aligns.len(), String::new());
+                    cells.resize(cols, String::new());
                     table.rows.push(cells.iter().zip(&aligns).map(|(s, a)| cell(s, false, *a)).collect());
                     i += 1;
                 }

crates/formats/src/markdown/tests.rs

@@ -714,3 +714,17 @@ fn exported_link_destinations_read_back_unchanged() {
     assert_eq!(md("https://example.com/a b"), "[x](<https://example.com/a b>)");
     assert_eq!(md("https://e.com/x\ny"), "[x](https://e.com/xy)");
 }
+
+#[test]
+fn a_wide_table_builds_only_the_cells_a_row_keeps() {
+    // A 5,000-column header padded every one-cell row below it to 5,000 cells.
+    let n = 5000;
+    let md = format!("{}|\n{}|\n{}", "|h".repeat(n), "|-".repeat(n), "|x|\n".repeat(200));
+    let flow = parse(&md);
+    let FBlock::Table(t) = &flow.blocks[0] else { panic!("expected table") };
+    assert_eq!(t.rows.len(), 201);
+    assert!(t.rows.iter().all(|r| r.len() == wordcraft_doc::table::MAX_COLS));
+    // A narrow table is unchanged.
+    let FBlock::Table(t) = &parse("| a | b |\n| - | - |\n| x |\n").blocks[0] else { panic!("expected table") };
+    assert_eq!(t.rows[1].len(), 2);
+}