fix(formats): copy an XLSX shared string only for a cell that is kept

crates/doc/src/link.rs

@@ -18,12 +18,6 @@ pub fn is_web_or_mail_link(url: &str) -> bool {
 /// names another machine — following it on Windows leaks the user's NTLM credentials — so it is
 /// refused too.
 pub fn is_safe_href(url: &str) -> bool {
-    // Exporters drop other control characters and noncharacters when they write the link
-    // (`file\u{85}:` comes out `file:`), so a link holding one is refused, not judged as it
-    // stands and written as something else.
-    if url.chars().any(|c| (c.is_control() && !c.is_ascii_control()) || matches!(c, '\u{FFFE}' | '\u{FFFF}')) {
-        return false;
-    }
     let cleaned: String = url.chars().filter(|c| !c.is_ascii_control() && *c != ' ').collect();
     // `//host` (protocol-relative) and `\\host` (UNC), with `\` read as `/` the way Windows does.
     if cleaned.replace('\\', "/").starts_with("//") {
@@ -93,10 +87,6 @@ mod tests {
             "\\\\attacker.example\\share\\x",
             "/\\attacker.example\\x",
             " //attacker.example/x",
-            // Characters the exporters drop on writing don't hide a scheme.
-            "file\u{85}:///etc/passwd",
-            "java\u{9F}script:alert(1)",
-            "/\u{FFFE}/attacker.example/x",
             "",
         ] {
             assert!(!is_safe_href(bad), "{bad:?}");

crates/formats/src/sheet/xlsx.rs

@@ -1,3 +1,5 @@
+use std::borrow::Cow;
+
 use super::date::{DateKind, builtin_date, custom_date, iso_datetime, serial_date};
 use super::{
     BTreeMap, Ev, Grid, HashMap, MAX_CELLS, MAX_COLS, MAX_ROWS, MAX_SHARED, MAX_SHEETS, MAX_XFS, Package, TextBudget, attr, push_capped, walk,
@@ -261,7 +263,7 @@ pub(super) fn xlsx_rows(pkg: &mut Package<'_>, path: &str) -> Result<Vec<Vec<Str
                     row.resize(c.col + 1, String::new());
                 }
                 if let Some(slot) = row.get_mut(c.col) {
-                    *slot = text;
+                    *slot = text.into_owned();
                 }
             }
             _ => {}
@@ -274,12 +276,15 @@ pub(super) fn xlsx_rows(pkg: &mut Package<'_>, path: &str) -> Result<Vec<Vec<Str
     Ok(grid.rows)
 }
 
-fn xlsx_value(c: &XCell, shared: &[String], formats: &[Option<DateKind>], date1904: bool) -> String {
+/// A cell's text: a shared string borrowed, so a cell the sheet then refuses (past the text
+/// budget, the columns or the rows) costs no copy of it.
+fn xlsx_value<'a>(c: &XCell, shared: &'a [String], formats: &[Option<DateKind>], date1904: bool) -> Cow<'a, str> {
     let v = c.value.trim();
     let kind = c.kind.trim();
     if kind.eq_ignore_ascii_case("s") {
-        v.parse::<usize>().ok().and_then(|i| shared.get(i)).cloned().unwrap_or_default()
-    } else if kind.eq_ignore_ascii_case("inlineStr") {
+        return Cow::Borrowed(v.parse::<usize>().ok().and_then(|i| shared.get(i)).map_or("", String::as_str));
+    }
+    Cow::Owned(if kind.eq_ignore_ascii_case("inlineStr") {
         if c.inline.is_empty() { c.value.clone() } else { c.inline.clone() }
     } else if kind.eq_ignore_ascii_case("str") || kind.eq_ignore_ascii_case("e") {
         c.value.clone()
@@ -290,12 +295,12 @@ fn xlsx_value(c: &XCell, shared: &[String], formats: &[Option<DateKind>], date19
     } else if v.is_empty() {
         c.inline.clone()
     } else {
-        let Ok(x) = v.parse::<f64>() else { return v.to_string() };
+        let Ok(x) = v.parse::<f64>() else { return Cow::Owned(v.to_string()) };
         match formats.get(c.style).copied().flatten() {
             Some(kind) => serial_date(x, date1904, kind).unwrap_or_else(|| number(x)),
             None => number(x),
         }
-    }
+    })
 }
 
 /// A number as a spreadsheet shows it in General format: up to 15 significant digits, no