Enforce Visio comment save limits

Author: PrzemyslawKlys

OfficeIMO.Tests/Visio.Comments.cs

@@ -201,6 +201,45 @@ public void LoadRejectsOversizedNativeCommentText() {
             Assert.Contains(VisioDocument.MaxCommentTextCharacters.ToString(), exception.Message);
         }
 
+        [Fact]
+        public void SaveRejectsTooManyNativeComments() {
+            string filePath = Path.Combine(Path.GetTempPath(), Guid.NewGuid() + ".vsdx");
+            VisioDocument document = VisioDocument.Create(filePath);
+            VisioPage page = document.AddPage("Review", 11, 8.5);
+            for (int index = 0; index <= VisioDocument.MaxLoadedComments; index++) {
+                page.Comments.Add(new VisioComment("Comment " + index.ToString()) {
+                    AuthorName = "Operations",
+                    AuthorInitials = "OP"
+                });
+            }
+
+            InvalidDataException exception = Assert.Throws<InvalidDataException>(() => document.Save());
+            Assert.Contains(VisioDocument.MaxLoadedComments.ToString(), exception.Message);
+        }
+
+        [Fact]
+        public void SaveRejectsOversizedNativeCommentText() {
+            string filePath = Path.Combine(Path.GetTempPath(), Guid.NewGuid() + ".vsdx");
+            VisioDocument document = VisioDocument.Create(filePath);
+            VisioPage page = document.AddPage("Review", 11, 8.5);
+            page.AddComment(new string('x', VisioDocument.MaxCommentTextCharacters + 1), "Operations", "OP");
+
+            InvalidDataException exception = Assert.Throws<InvalidDataException>(() => document.Save());
+            Assert.Contains(VisioDocument.MaxCommentTextCharacters.ToString(), exception.Message);
+        }
+
+        [Fact]
+        public void SaveRejectsCommentsPartThatExceedsUtf8ByteLimit() {
+            string filePath = Path.Combine(Path.GetTempPath(), Guid.NewGuid() + ".vsdx");
+            VisioDocument document = VisioDocument.Create(filePath);
+            VisioPage page = document.AddPage("Review", 11, 8.5);
+            VisioComment comment = page.AddComment("Byte budget", "Operations", "OP");
+            comment.AuthorName = new string('\u20ac', checked((int)(VisioDocument.MaxCommentsPartBytes / 3L + 1024L)));
+
+            InvalidDataException exception = Assert.Throws<InvalidDataException>(() => document.Save());
+            Assert.Contains(VisioDocument.MaxCommentsPartBytes.ToString(), exception.Message);
+        }
+
         private static void AssertNativeCommentPackage(
             string filePath,
             string expectedText,

OfficeIMO.Visio/VisioDocument.SaveCore.Comments.cs

@@ -49,13 +49,17 @@ private static void WriteCommentsPart(
 
             foreach (VisioPage page in pages) {
                 foreach (VisioComment comment in page.Comments) {
+                    ValidateCommentForSave(comment);
                     CommentAuthorKey authorKey = new(comment.AuthorName, comment.AuthorInitials, comment.AuthorResolutionId);
                     if (!authorIds.TryGetValue(authorKey, out int authorId)) {
                         authorId = authorIds.Count + 1;
                         authorIds.Add(authorKey, authorId);
                     }
 
                     comments.Add((page, comment, authorId));
+                    if (comments.Count > MaxLoadedComments) {
+                        throw new InvalidDataException($"Visio comments part contains more than {MaxLoadedComments} comments.");
+                    }
                 }
             }
 
@@ -104,9 +108,30 @@ private static void WriteCommentsPart(
                 authorList,
                 commentList));
 
+            string serializedComments = commentsXml.Declaration + Environment.NewLine + commentsXml.ToString(SaveOptions.DisableFormatting);
+            ValidateCommentsXmlForSave(serializedComments);
+
             using Stream stream = commentsPart.GetStream(FileMode.Create, FileAccess.Write);
             using StreamWriter writer = new(stream, new UTF8Encoding(false));
-            writer.Write(commentsXml.Declaration + Environment.NewLine + commentsXml.ToString(SaveOptions.DisableFormatting));
+            writer.Write(serializedComments);
+        }
+
+        private static void ValidateCommentForSave(VisioComment comment) {
+            string text = comment.Text ?? string.Empty;
+            if (text.Length > MaxCommentTextCharacters) {
+                throw new InvalidDataException($"Visio comment text exceeds {MaxCommentTextCharacters} characters.");
+            }
+        }
+
+        private static void ValidateCommentsXmlForSave(string commentsXml) {
+            if (commentsXml.Length > MaxCommentsXmlCharacters) {
+                throw new InvalidDataException($"Visio comments part exceeds {MaxCommentsXmlCharacters} XML characters.");
+            }
+
+            int byteCount = Encoding.UTF8.GetByteCount(commentsXml);
+            if (byteCount > MaxCommentsPartBytes) {
+                throw new InvalidDataException($"Visio comments part exceeds {MaxCommentsPartBytes} bytes.");
+            }
         }
 
         private static int AssignSaveFallbackCommentId(VisioComment comment, XElement commentList) {