From 2ae631376b95ff0a59ea18c2c0befcd50135b020 Mon Sep 17 00:00:00 2001
From: xuri <xuri.me@gmail.com>
Date: Fri, 29 May 2020 00:26:40 +0800
Subject: [PATCH] add limits for total columns, row and filename length

---
 cell.go          | 10 +++++-----
 excelize_test.go |  1 +
 file.go          |  4 ++++
 lib.go           |  7 ++++++-
 lib_test.go      |  5 ++++-
 xmlDrawing.go    |  9 +++++++++
 6 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/cell.go b/cell.go
index 6981cce..064c432 100644
--- a/cell.go
+++ b/cell.go
@@ -281,8 +281,8 @@ func (f *File) SetCellStr(sheet, axis, value string) error {
 // setCellString provides a function to set string type to shared string
 // table.
 func (f *File) setCellString(value string) (t string, v string, ns xml.Attr) {
-	if len(value) > 32767 {
-		value = value[0:32767]
+	if len(value) > TotalCellChars {
+		value = value[0:TotalCellChars]
 	}
 	// Leading and ending space(s) character detection.
 	if len(value) > 0 && (value[0] == 32 || value[len(value)-1] == 32) {
@@ -311,8 +311,8 @@ func (f *File) setSharedString(val string) int {
 
 // setCellStr provides a function to set string type to cell.
 func setCellStr(value string) (t string, v string, ns xml.Attr) {
-	if len(value) > 32767 {
-		value = value[0:32767]
+	if len(value) > TotalCellChars {
+		value = value[0:TotalCellChars]
 	}
 	// Leading and ending space(s) character detection.
 	if len(value) > 0 && (value[0] == 32 || value[len(value)-1] == 32) {
@@ -476,7 +476,7 @@ func (f *File) SetCellHyperLink(sheet, axis, link, linkType string) error {
 		xlsx.Hyperlinks = new(xlsxHyperlinks)
 	}
 
-	if len(xlsx.Hyperlinks.Hyperlink) > 65529 {
+	if len(xlsx.Hyperlinks.Hyperlink) > TotalSheetHyperlinks {
 		return errors.New("over maximum limit hyperlinks in a worksheet")
 	}
 
diff --git a/excelize_test.go b/excelize_test.go
index 5b65109..b31e1c8 100644
--- a/excelize_test.go
+++ b/excelize_test.go
@@ -166,6 +166,7 @@ func TestOpenFile(t *testing.T) {
 		assert.NoError(t, f.SetCellStr("Sheet2", "c"+strconv.Itoa(i), strconv.Itoa(i)))
 	}
 	assert.NoError(t, f.SaveAs(filepath.Join("test", "TestOpenFile.xlsx")))
+	assert.EqualError(t, f.SaveAs(filepath.Join("test", strings.Repeat("c", 199), ".xlsx")), "file name length exceeds maximum limit")
 }
 
 func TestSaveFile(t *testing.T) {
diff --git a/file.go b/file.go
index 8fe4115..e8f29da 100644
--- a/file.go
+++ b/file.go
@@ -12,6 +12,7 @@ package excelize
 import (
 	"archive/zip"
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -62,6 +63,9 @@ func (f *File) Save() error {
 // SaveAs provides a function to create or update to an xlsx file at the
 // provided path.
 func (f *File) SaveAs(name string) error {
+	if len(name) > FileNameLength {
+		return errors.New("file name length exceeds maximum limit")
+	}
 	file, err := os.OpenFile(name, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0666)
 	if err != nil {
 		return err
diff --git a/lib.go b/lib.go
index 91b3635..d97bb20 100644
--- a/lib.go
+++ b/lib.go
@@ -135,6 +135,9 @@ func ColumnNameToNumber(name string) (int, error) {
 		}
 		multi *= 26
 	}
+	if col > TotalColumns {
+		return -1, fmt.Errorf("column number exceeds maximum limit")
+	}
 	return col, nil
 }
 
@@ -172,7 +175,9 @@ func CellNameToCoordinates(cell string) (int, int, error) {
 	if err != nil {
 		return -1, -1, fmt.Errorf(msg, cell, err)
 	}
-
+	if row > TotalRows {
+		return -1, -1, fmt.Errorf("row number exceeds maximum limit")
+	}
 	col, err := ColumnNameToNumber(colname)
 	return col, row, err
 }
diff --git a/lib_test.go b/lib_test.go
index 0e717b2..229412c 100644
--- a/lib_test.go
+++ b/lib_test.go
@@ -23,7 +23,6 @@ var validColumns = []struct {
 	{Name: "AZ", Num: 26 + 26},
 	{Name: "ZZ", Num: 26 + 26*26},
 	{Name: "AAA", Num: 26 + 26*26 + 1},
-	{Name: "ZZZ", Num: 26 + 26*26 + 26*26*26},
 }
 
 var invalidColumns = []struct {
@@ -72,6 +71,8 @@ func TestColumnNameToNumber_Error(t *testing.T) {
 			assert.Equalf(t, col.Num, out, msg, col.Name)
 		}
 	}
+	_, err := ColumnNameToNumber("XFE")
+	assert.EqualError(t, err, "column number exceeds maximum limit")
 }
 
 func TestColumnNumberToName_OK(t *testing.T) {
@@ -172,6 +173,8 @@ func TestCellNameToCoordinates_Error(t *testing.T) {
 			assert.Equalf(t, -1, r, msg, cell)
 		}
 	}
+	_, _, err := CellNameToCoordinates("A1048577")
+	assert.EqualError(t, err, "row number exceeds maximum limit")
 }
 
 func TestCoordinatesToCellName_OK(t *testing.T) {
diff --git a/xmlDrawing.go b/xmlDrawing.go
index 808bed5..b2eeed6 100644
--- a/xmlDrawing.go
+++ b/xmlDrawing.go
@@ -80,6 +80,15 @@ const (
 	ExtURIMacExcelMX             = "{64002731-A6B0-56B0-2670-7721B7C09600}"
 )
 
+// Excel specifications and limits
+const (
+	FileNameLength       = 207
+	TotalRows            = 1048576
+	TotalColumns         = 16384
+	TotalSheetHyperlinks = 65529
+	TotalCellChars       = 32767
+)
+
 var supportImageTypes = map[string]string{".gif": ".gif", ".jpg": ".jpeg", ".jpeg": ".jpeg", ".png": ".png", ".tif": ".tiff", ".tiff": ".tiff"}
 
 // xlsxCNvPr directly maps the cNvPr (Non-Visual Drawing Properties). This