fix(doc): refuse export links holding characters the writers drop

crates/doc/src/link.rs

@@ -18,6 +18,12 @@ pub fn is_web_or_mail_link(url: &str) -> bool {
 /// names another machine — following it on Windows leaks the user's NTLM credentials — so it is
 /// refused too.
 pub fn is_safe_href(url: &str) -> bool {
+    // Exporters drop other control characters and noncharacters when they write the link
+    // (`file\u{85}:` comes out `file:`), so a link holding one is refused, not judged as it
+    // stands and written as something else.
+    if url.chars().any(|c| (c.is_control() && !c.is_ascii_control()) || matches!(c, '\u{FFFE}' | '\u{FFFF}')) {
+        return false;
+    }
     let cleaned: String = url.chars().filter(|c| !c.is_ascii_control() && *c != ' ').collect();
     // `//host` (protocol-relative) and `\\host` (UNC), with `\` read as `/` the way Windows does.
     if cleaned.replace('\\', "/").starts_with("//") {
@@ -87,6 +93,10 @@ mod tests {
             "\\\\attacker.example\\share\\x",
             "/\\attacker.example\\x",
             " //attacker.example/x",
+            // Characters the exporters drop on writing don't hide a scheme.
+            "file\u{85}:///etc/passwd",
+            "java\u{9F}script:alert(1)",
+            "/\u{FFFE}/attacker.example/x",
             "",
         ] {
             assert!(!is_safe_href(bad), "{bad:?}");

crates/render/src/lib.rs

@@ -836,22 +836,10 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
-/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
-/// flattens a curve into as many points as its size asks for, before clipping, so a path with
-/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
-/// memory; one this far past every canvas shows nothing a real drawing would.
-const MAX_PATH_PIXELS: f64 = 1_048_576.0;
-
-/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
-fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
-    let b = view.transform_rect_bbox(path.bounding_box());
-    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
-}
-
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
+    if path.elements().is_empty() {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1318,18 +1318,3 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
-
-#[test]
-fn paths_far_past_every_canvas_are_not_flattened() {
-    let line = |x: f64| {
-        let mut p = kurbo::BezPath::new();
-        p.move_to((0.0, 0.0));
-        p.curve_to((x, 0.0), (x, x), (0.0, x));
-        p
-    };
-    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
-    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
-    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
-    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
-    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
-}