You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add header-only GetInfo image-info probing to all codecs - #4
Adds a header-only GetInfo API to BmpCodec, PngCodec, TiffCodec, and JpegCodec that
parses only the file/stream header to report claimed image dimensions/format info, without
performing the expensive full pixel decode. This lets callers inspect a file's declared size
(ImageInfo.Width/Height) and reject a suspected decompression-bomb / image-bomb file before calling Load, which allocates a full RGBA32 Surface buffer.
varinfo=PngCodec.GetInfo("untrusted.png");if((long)info.Width*info.Height>4096L*4096L||info.Width>Surface.MaxDimension||info.Height>Surface.MaxDimension){// reject before calling PngCodec.Load(...)}
Changes
New shared CanvasNet.Codecs.ImageInfo record struct (Width, Height, Channels, HasAlpha).
GetInfo(Stream) / GetInfo(string path) added to all four codecs, mirroring the existing Load overload-pairing convention and exception contract exactly (ArgumentNullException, ArgumentException, InvalidDataException).
GetInfo reports raw header dimensions and does not enforce Surface.MaxDimension -
by design, so a caller can detect and reject oversized files that would otherwise fail inside Load.
Each codec's header-parsing helper was refactored to take an enforceMaxDimension flag so Load (true, unchanged behavior) and GetInfo (false) share one parsing code path -
no duplicated/divergent parsers.
TiffCodec.GetInfo uses a genuinely lightweight, seek-based IFD tag probe (reads only the
header + the needed inline/out-of-line tags, never buffers the whole file or reads strip
data). It requires a seekable stream: since a TIFF's IFD can legitimately be located anywhere
in the file, a non-seekable stream is rejected immediately with NotSupportedException,
before any bytes are read, rather than falling back to buffering.
JpegCodec.GetInfo scans marker segments to find SOF0/SOF2 (skipping segment data, never
entropy-decoding), bounded by a new MaxProbeHeaderBytes (1 MiB) limit.
Surface.MaxDimension widened from internal to public const int so external callers can
compare GetInfo's reported dimensions against the same bound Load enforces.
Comprehensive new test coverage per codec (valid w/ and w/o alpha, null/empty-path validation,
malformed headers, oversized-dimensions-not-rejected, proof that GetInfo never reads past the
header, TIFF non-seekable stream rejection, JPEG probe-limit-exceeded).
Companion artifacts updated per this repo's Continuous Compliance conventions: requirements
(docs/reqstream/**), design docs (docs/design/**), verification docs (docs/verification/**),
SysML2 model sourceRef updates, .reviewmark.yaml review-set coverage, README and user guide.
Validation
dotnet build: 0 warnings, 0 errors.
pwsh ./build.ps1: 1497/1497 tests passed (499 distinct test methods x 3 TFMs: net8.0/net9.0/net10.0).
dotnet reqstream --requirements requirements.yaml --enforce: exit 0, 0 orphans (unchanged
from the pre-existing baseline on main, which was also 0 orphans).
This is new user-visible public API (ImageInfo, four GetInfo overload pairs, and Surface.MaxDimension visibility widening), so it is delivered as its own feature branch/PR
rather than folded into #3.
Add ImageInfo (Width/Height/Channels/HasAlpha) and a public static
GetInfo(Stream)/GetInfo(string) API to BmpCodec, PngCodec, TiffCodec, and
JpegCodec that parses only the file/stream header to report claimed image
dimensions without performing the expensive full pixel decode. This lets
callers inspect a file's declared size and reject suspected
decompression-bomb / image-bomb files before Load allocates a Surface.
- Refactor each codec's header-parsing helper to accept an
enforceMaxDimension flag so Load (true, unchanged behavior) and GetInfo
(false, reports raw header dimensions) share one parsing code path.
- BmpCodec/PngCodec: extract existing header/IHDR parsing into a shared
helper.
- JpegCodec: extract marker-scanning logic to find SOF0/SOF2 while
skipping segment data (no entropy decode); bound the scan with
MaxProbeHeaderBytes (1 MiB) to avoid unbounded reads on pathological
input.
- TiffCodec: add a seek-based IFD tag probe for seekable streams that
reads only the header and the four needed inline SHORT tags
(ImageWidth, ImageLength, SamplesPerPixel, ExtraSamples) without
buffering the whole file or touching strip data; fall back to the
existing full-buffer parse for non-seekable streams.
- Widen Surface.MaxDimension from internal to public const so external
callers can compare GetInfo's reported dimensions against the same
bound Load enforces.
Add GetInfo test coverage to Bmp/Png/Tiff/JpegCodecTests covering: valid
files with and without alpha, null stream/path, empty path,
malformed/truncated headers, oversized dimensions being reported (not
rejected) unlike Load on the same bytes, and proof that GetInfo never
reads past the header/marker region (bounded-read stream / stream
position assertions). Adds TIFF coverage for both the seekable
seek-based probe path and the non-seekable full-buffer fallback path,
and a JPEG probe-limit-exceeded case. Adds a Surface.MaxDimension
public-accessibility test.
New shared test helpers:
- TestSupport/BoundedReadStream.cs: wraps a stream and throws if read
past a configured boundary, proving GetInfo does not decode pixel
data.
- TestSupport/NonSeekableStream.cs: forces CanSeek == false to exercise
TiffCodec's non-seekable fallback path.
- Requirements (docs/reqstream): new GetInfo requirements (functional +
validation) for each codec, and for Surface.MaxDimension becoming
public, linked as children of existing root-tagged requirements so
reqstream --enforce reports zero orphans (unchanged from baseline).
- Design docs (docs/design): document ImageInfo, the GetInfo API and its
raw-dimension-reporting contract, and TIFF's seek-based probe with
non-seekable fallback.
- Verification docs (docs/verification): new test scenarios and
corrected test-count totals for each codec unit.
- SysML2 model: extend sourceRef for each codec unit to include
ImageInfo.cs.
- .reviewmark.yaml: add ImageInfo.cs and the new TestSupport helper
files to the relevant review-sets.
- README.md / docs/user_guide/introduction.md: document the new public
GetInfo API with a bomb-triage usage example comparing reported
dimensions against Surface.MaxDimension before calling Load.
- .cspell.yaml: add legitimate technical dictionary words introduced by
the new documentation/code.
Adds header-only GetInfo APIs for BMP, PNG, TIFF, and JPEG codecs, plus shared image metadata and public dimension limits for safer pre-decode validation.
Changes:
Added ImageInfo and GetInfo APIs across all codecs.
Added probing tests and stream helpers.
Updated documentation, requirements, verification, SysML2, and review coverage.
- Introduce internal ITiffDataSource abstraction (ByteArrayTiffDataSource,
StreamTiffDataSource) so ParseIfd/ReadTagValues/RequireTagValues/
TryGetTagValues/ReadTiffImageInfo operate against a single abstraction
instead of a raw byte[]
- Load and both GetInfo branches now call the same ReadTiffImageInfo,
eliminating the divergence where the seekable probe defaulted
SamplesPerPixel to 1 and skipped most format-support validation
- Delete ProbeIfdEntriesSeekable and ReadInlineEntryValue (dead code)
- Update XML docs on GetInfo/TiffCodec/ImageInfo to describe the unified
behavior and the full set of InvalidDataException reasons GetInfo can
now throw
- Update tiff-codec design/verification docs for the new architecture
- Add parity regression tests proving identical GetInfo results (and
identical throwing behavior) for the same TIFF bytes across seekable
and non-seekable streams
Only Load enforces Surface.MaxDimension; GetInfo deliberately does not.
The previous prose incorrectly stated both Load and GetInfo compared
against MaxDimension in their own methods, contradicting the correct
statement elsewhere in the same design document.
Add the CanvasNet-Canvas-Surface-MaxDimensionPublic Test Scenarios entry,
matching the format of the other scenario entries in this file, for the
already-existing requirement and test.
The test assembly already has InternalsVisibleTo access to the main
assembly, so a plain compile-time reference to Surface.MaxDimension
cannot distinguish public from internal. Add a reflection-based
FieldInfo.IsPublic assertion, which is unaffected by InternalsVisibleTo,
and correct the XML doc to describe the actual proof.
README.md's single shared Usage using block and Example 8's own using
block in docs/user_guide/introduction.md both throw InvalidDataException
without importing System.IO, so the example code did not compile as
shown.
StreamTiffDataSource.ReadBytes (used only by GetInfo's seekable fast
path) allocated new byte[length] for an out-of-line tag value array
before validating length against the stream's actual size. A tiny,
mostly-garbage TIFF file could declare an attacker-controlled tag
Count in the hundreds of millions (e.g. via BitsPerSample), forcing a
huge up-front allocation on the very fast path GetInfo exists to make
safe for untrusted/oversized input - a ~1.8 GB allocation from a
66-byte file, verified empirically during code review.
Validate the requested range against stream.Length before allocating,
mirroring the bounds checking ByteArrayTiffDataSource already performs
via CheckBounds. Add a regression test proving the seekable path now
fails fast with InvalidDataException instead of attempting the
oversized allocation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… regression test
The prior version of TiffCodec_GetInfo_Seekable_MaliciousOutOfLineTagLength_ThrowsWithoutUnboundedAllocation
asserted only exception type/message and a wall-clock time budget. A code-review
pass found this did not actually distinguish vulnerable from fixed code: a
modern allocator can zero and hand back a ~1.8 GB buffer in single-digit
milliseconds, and the resulting InvalidDataException message is identical
either way (the pre-existing end-of-stream check and the new bounds check
produce the same text). Measure GC.GetAllocatedBytesForCurrentThread() before
and after the call instead, and assert the delta stays under 1 MB. Verified
this version fails (reporting ~1.8 GB allocated) against the pre-fix code and
passes against the fix.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Unlike Load, neither GetInfo branch checks for TagTileWidth/TagTileLength before returning metadata. A tiled TIFF therefore succeeds here even though the same bytes are rejected by Load as unsupported, contradicting this API's documented same-format-validation contract and the codec's strip-only support. Reuse the existing tiled-image check for both probe branches (ideally through one shared helper also called by Load).
- PNG GetInfo: validate IHDR chunk type and length before allocating
the payload buffer, closing an allocate-before-validate gap.
- JPEG GetInfo: replace fixed-size upfront read with an incremental
probe buffer that grows only as needed; unify SOF/frame-marker
rejection between Load and GetInfo via a shared helper.
- TIFF: cap image-level tag cardinality (MaxImageLevelTagCount = 8)
before allocating tag value arrays; replace bare checked((int)...)
casts on attacker-controlled offsets/counts with ToInt32Checked,
which throws InvalidDataException instead of letting
OverflowException escape (including two casts in DecodeStrip found
by code review); reject tiled TIFFs consistently in both GetInfo
branches via the shared ReadTiffImageInfo helper; fix
StreamTiffDataSource to treat IFD offsets as relative to the
stream's starting position (basePosition) instead of absolute,
fixing seekable-stream probing for TIFFs embedded at a nonzero
offset.
- Add regression tests for all fixes, using allocated-byte counts
(not wall-clock timing) to prove DoS-resistant behavior, and
empirically verified against the pre-fix code per the established
revert/confirm-fail/restore protocol.
- Update design, verification, reqstream, and user guide docs to
match.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- TIFF: GetInfo's non-seekable fallback used to buffer the entire
remainder of the stream via Stream.CopyTo before parsing any tag, so
a hostile or merely oversized non-seekable stream (e.g. a network
stream) could force an unbounded allocation even though GetInfo
exists for cheap pre-decode bomb triage. Add a MaxNonSeekableProbeBytes
(1 MiB) cap, mirroring JpegCodec's existing MaxProbeHeaderBytes
design, and a ReadStreamBounded helper that stops buffering once the
cap is reached. A non-seekable stream whose IFD or a needed tag
value lies beyond the cap is now rejected with InvalidDataException
via the existing ByteArrayTiffDataSource bounds check, an intentional
divergence from the uncapped seekable path documented in the XmlDoc,
design doc, and reqstream requirement.
- JPEG: IncrementalProbeBuffer.ToExactArray used to unconditionally
report 'unexpected end of stream' when the SOF segment's declared
length required reading past MaxProbeHeaderBytes, even though the
stream was not actually truncated. Check CapReached (as the sibling
ProbeExhaustedException helper already does for the marker-scan
case) so this is now reported as the probe limit instead.
- Investigated a third claimed finding (potential IndexOutOfRangeException
in ProbeDimensions for a truncated SOF) and confirmed it is a false
positive: ReadSof reads every field through the already bounds-checked
ReadByte/ReadUInt16Be helpers, verified empirically with a crafted
malformed SOF segment. No code change made for this one.
- Add regression tests for both fixes, empirically verified against
the pre-fix code per the established revert/confirm-fail/restore
protocol, and update design/verification/reqstream docs accordingly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Copilot review overview
🟡 Changes recommended
The seekable TIFF probe can perform excessive attacker-controlled reads and allocations, and several documentation contracts are inconsistent with the bounded behavior.
Get a fresh assessment by requesting another Copilot review.
… GetInfo
Round 4 of PR #4 review fixes: the previous round only updated the
Load(Stream) remarks and the feature-level TIFF requirement to describe
the bounded (1 MiB) non-seekable probe buffer. This round sweeps the
remaining stale copies of the old "buffers the whole stream" claim:
- docs/reqstream/canvas-net.yaml (system-level requirement)
- docs/reqstream/canvas-net/codecs.yaml (subsystem-level requirement)
- docs/user_guide/introduction.md
- ByteArrayTiffDataSource XmlDoc in TiffCodec.cs
All now describe the MaxNonSeekableProbeBytes-bounded fallback and the
InvalidDataException thrown when data lies beyond the cap, instead of
claiming an unbounded whole-stream buffer.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
TIFF's IFD can be located anywhere in the file (unlike PNG/JPEG/BMP,
which only need forward scanning near the start), so probing a
non-seekable stream previously required buffering up to a fixed 1 MiB
cap (MaxNonSeekableProbeBytes) before parsing. That bounded-buffer
fallback was the source of repeated review churn across several PR
rounds (unbounded buffering DoS, then bounded-but-still-complex logic,
recurring stale documentation).
Since a caller with a genuinely non-seekable TIFF source can trivially
wrap it in a MemoryStream themselves if they want probing,
GetInfo(Stream) now rejects non-seekable streams outright with
NotSupportedException, thrown before any bytes are read from the
stream. This removes the MaxNonSeekableProbeBytes constant and the
ReadStreamBounded helper entirely, along with the content-dependent
non-seekable test coverage that is no longer meaningful (replaced with
two focused tests proving the exception is thrown purely for
non-seekability, before any stream I/O).
Updated XmlDoc, design docs, verification docs, reqstream requirements
(system/subsystem/feature level), and the user guide to describe the
new behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…n codecs design doc
The subsystem-level Codecs design doc still described TiffCodec.GetInfo
as using a 'seek-based-with-fallback' strategy, and the general
GetInfo exception-contract sentence didn't mention the NotSupportedException
TiffCodec.GetInfo(Stream) now throws for a non-seekable stream. Both are
now accurate to the seek-only, no-fallback behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add CanvasNetVsdx design, requirements, and SysML2 skeleton
Lays the documentation groundwork for a new DemaConsulting.CanvasNet.Vsdx
NuGet package providing Microsoft Visio (.vsdx) diagram-rendering support,
following the software-items.md standard:
- docs/design/canvas-net-vsdx.md + canvas-net-vsdx/vsdx-document.md: system
and unit design docs, describing the complete final feature set (shipped
as a single PR) with an ordered 9-milestone internal implementation plan.
- docs/sysml2/model/canvas-net-vsdx.sysml + subfolder: SysML2 architecture
model, wired into docs/sysml2/views/design-views.sysml.
- docs/reqstream/canvas-net-vsdx.yaml + subfolder: requirement entries
(CanvasNetVsdx-* / CanvasNetVsdx-VsdxDocument-* IDs) covering package
parsing, geometry/transform, master/stencil inheritance, style
resolution, text, connectors, color/theme, and the public Render API;
wired into root requirements.yaml.
- docs/verification/canvas-net-vsdx.md + subfolder: TODO verification
stubs, to be completed once the test suite exists.
- docs/design/introduction.md and .reviewmark.yaml updated to reference
the new system.
A research pass (not committed - see session artifacts) grounded this
design in real sample .vsdx files from the permissively-licensed
dave-howard/vsdx (BSD-3-Clause) and jgreywolf/vsdx-js (MIT) repositories;
14 of those sample files are staged for the later test-suite milestone at
test/DemaConsulting.CanvasNet.Vsdx.Tests.Fixtures-STAGING/.
No C# source/project files yet - implementation follows in subsequent
local commits per the phase plan in docs/design/canvas-net-vsdx.md.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add CanvasNetVsdx project scaffolding (Milestone 1)
Creates the empty, compiling project skeletons for the new
DemaConsulting.CanvasNet.Vsdx system, per Milestone 1 ("Project
scaffolding") of docs/design/canvas-net-vsdx.md's Implementation
Phase Plan.
- src/DemaConsulting.CanvasNet.Vsdx/DemaConsulting.CanvasNet.Vsdx.csproj:
new library project mirroring the sibling Pptx/Pdf/Charts csproj
conventions (net8.0/net9.0/net10.0, analyzers, SBOM, ApiMark,
SourceLink), referencing only the core DemaConsulting.CanvasNet
project (no Charts/Svg/Pdf dependency, per the design doc). Uses the
newest package versions currently in use anywhere in the repo
(DemaConsulting.ApiMark.MSBuild 0.5.4, SonarAnalyzer.CSharp
10.35.0.4138, Microsoft.CodeAnalysis.NetAnalyzers 10.0.401,
Microsoft.Sbom.Targets 4.1.13, Microsoft.SourceLink.GitHub
10.0.401).
- src/DemaConsulting.CanvasNet.Vsdx/NamespaceDoc.cs: forward-looking
namespace XML doc describing the final VsdxDocument feature set
(OPC package layer, page/master/style model, geometry+transform,
master/stencil inheritance, text, connector/glue-point routing,
color/theme resolution, public Render API), with a remarks note
that implementation is in progress and detailed scope will be
filled in on VsdxDocument as milestones land.
- src/DemaConsulting.CanvasNet.Vsdx/VsdxDocument.cs: an empty, public
sealed partial class VsdxDocument with only a one-line summary -
partial so later milestones can add VsdxDocument.*.cs files
(mirroring PptxDocument's own partial-class-per-concern
convention) without touching this file.
- test/DemaConsulting.CanvasNet.Vsdx.Tests/
DemaConsulting.CanvasNet.Vsdx.Tests.csproj: new xunit v3 test
project mirroring the sibling *.Tests.csproj conventions,
referencing only the new Vsdx project. The shared TestSupport
synthetic-font-helper link is intentionally omitted - this
milestone has no text-rendering code yet; a later milestone can
add it.
- test/DemaConsulting.CanvasNet.Vsdx.Tests/VsdxDocumentTests.cs: one
trivial smoke test confirming VsdxDocument exists and is
referenceable.
- CanvasNet.slnx: wires both new projects into the existing /src/
and /test/ solution folders, positioned immediately after their
Pptx counterparts (matching the existing, non-alphabetical but
consistent ordering).
Deferred to later milestones per the phase plan: OPC package
parsing/Open(...), page enumeration, shape/geometry model,
master/stencil inheritance, style resolution, text rendering,
connector/glue-point routing, theme/color resolution, the public
Render API, and promoting
test/DemaConsulting.CanvasNet.Vsdx.Tests.Fixtures-STAGING/ into this
test project (left untouched here).
Verified: dotnet build CanvasNet.slnx (0 warnings, 0 errors across
all three target frameworks); dotnet test on the new
DemaConsulting.CanvasNet.Vsdx.Tests project (3/3 passed - net8.0,
net9.0, net10.0); fix.ps1 run (no changes needed beyond what was
already formatted); dotnet format --verify-no-changes clean. lint.ps1
still reports pre-existing, out-of-scope cspell findings in
docs/design/introduction.md, docs/design/canvas-net-vsdx.md, and
test/DemaConsulting.CanvasNet.Vsdx.Tests.Fixtures-STAGING/ from the
prior commit; none are introduced by this change.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix cspell gaps in VSDX design/fixture docs
Adds missing technical terms (Visio, slnx, jgreywolfvsdxjs, Greywolf,
Lucidchart, basicshapes, diagramwithstyles, flowchartshapes) to existing
cspell:ignore comments, surfaced by lint.ps1 after the design-doc and
fixture-staging commits. Full lint.ps1 now passes clean.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 2: OPC package layer + page enumeration
Implements the OPC/ZIP package layer and page index resolution for
DemaConsulting.CanvasNet.Vsdx, mirroring the proven PptxDocument precedent:
- VsdxDocument.Open(Stream) / Open(string path): opens a .vsdx as a
read-only ZIP archive with bounded buffering (MaxPackageBytes).
- VsdxDocument.Package.cs: generic OPC mechanics - [Content_Types].xml
parsing, relationship parsing/caching (_rels/.rels and part-level
.rels), "../"-relative target resolution, ResolveRelationshipByType /
TryResolveRelationshipByType, XXE-hardened XML loading.
- VsdxDocument.Pages.cs: resolves visio/document.xml (required) and
visio/pages/pages.xml (required) via relationship type; resolves
visio/masters/masters.xml and visio/theme/theme1.xml if present but
does not require them (confirmed optional via real fixture evidence
and the design doc's own exception contract); parses each <Page>'s
Name/NameU, PageWidth/PageHeight cells (inches -> EMU, ignoring any
U= formatting-hint attribute).
- VsdxPageInfo: readonly record struct (Name, WidthEmu, HeightEmu)
mirroring PptxSlideSize's shape/unit convention.
- PageCount property and GetPageSize(int) method exposed on
VsdxDocument, with idempotent Dispose().
- Exception contract mirrors Pptx exactly: ArgumentNullException/
ArgumentException for null/empty stream or path; InvalidDataException
for corrupt ZIP or a missing/empty required part. No new custom
exception type was needed.
- Full Milestone-2 test suite in VsdxDocumentTests.cs covering all
forward-declared reqstream test names, the full negative/validation
matrix, and real-fixture sanity checks (including a loop over all 14
staged sample files from the Fixtures-STAGING folder, wired into the
test project via a Link-based fixture include).
Deferred to later milestones (3+): shape/geometry parsing, masters/
styles/theme content, text, connectors, and rendering. Page-content
parts (visio/pages/pageN.xml) are intentionally not resolved yet.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 3: Shape/geometry model + master/stencil inheritance + style resolution
Implements the internal per-shape resolution model for .vsdx diagrams:
- Shape tree parsing: generic Cell/Section cell-bag model for <Shapes>/<Shape>
XML (VsdxCell, VsdxCellBag, VsdxShapeNode), forward-compatible with future
group/nested-shape composition (Milestone 6).
- Master/Stencil resolution: visio/masters/masters.xml + per-master
masterN.xml parsing, with cell and geometry-row override-merge (including
the geometry-row-delete pattern) when a page shape references Master="N".
- StyleSheet chain resolution from visio/document.xml's <StyleSheets>,
including built-in style IDs, with a shape's direct cell overrides taking
final precedence.
- Geometry row parsing (MoveTo/LineTo/RelMoveTo/RelLineTo); other row types
(ArcTo, RelCubBezTo, Ellipse, etc.) are skipped gracefully per the design
doc's Risk Control Measures section, not thrown.
- 2-D and 1-D shape-local-to-page-coordinate affine transform, verified
against the format reference's worked rotation example with exact
expected-coordinate assertions.
- FillPattern 0/1 solid-or-none color/fill resolution with literal-RGB
fallback; Themed colors get a tolerant neutral-gray fallback pending full
theme/built-in-palette support.
- Reuses existing core Path/PathBuilder/Vector2/Rgba32 primitives from
DemaConsulting.CanvasNet; no parallel geometry/paint types invented.
New files: VsdxCell.cs, VsdxCellBag.cs, VsdxGeometry.cs, VsdxShapeTransform.cs,
VsdxResolvedPaint.cs, VsdxColorPalette.cs, VsdxUnsupportedFeatureException.cs,
VsdxShapeNode.cs, VsdxDocument.Shapes.cs, VsdxDocument.Masters.cs,
VsdxDocument.CellMerge.cs, VsdxDocument.Geometry.cs, VsdxDocument.Transform.cs,
VsdxDocument.Styles.cs, VsdxDocument.Paint.cs, plus VsdxTestPackages.cs and
five new test classes (Geometry/Transform/MasterInheritance/
StyleResolution/FixtureShapeResolution).
Deferred to later milestones: text (M4), connectors/glue-points (M5),
recursive group/nested-shape composition (M6), Themed/full built-in color
palette (M6), public Render API / pixel painting onto Surface (M7).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 4: text parsing, TextStyle resolution, and layout
Implements Milestone 4 ("Text rendering") of the Vsdx 9-milestone plan:
- Parse each shape's <Text> element (character data interleaved with
<cp IX="..."> / <pp IX="..."> run and paragraph markers) into an
ordered sequence of raw text runs (VsdxDocument.Text.cs,
VsdxTextRun.cs).
- Resolve character properties (font family/size/color/bold/italic) via
Section N="Character" cells and paragraph properties (alignment,
spacing) via Section N="Paragraph" cells, through the same TextStyle
StyleSheet chain-walking pattern already used for LineStyle/FillStyle
in Milestone 3 (instance -> Master -> Stencil -> built-in defaults),
plus direct per-shape text-section overrides
(VsdxDocument.TextStyle.cs, VsdxDocument.CellMerge.cs,
VsdxDocument.Styles.cs).
- Text-box positioning: implicit default equal to the shape's own
geometry bounding box in shape-local coordinates, with support for
explicit TxtPinX/TxtPinY/TxtWidth/TxtHeight/TxtAngle override cells
(VsdxDocument.TextBox.cs, VsdxTextBoxTransform.cs).
- Word-wrap/line-breaking and horizontal/vertical alignment within the
resolved text box, mirroring the Pptx text-layout tokenize/pack/
position pipeline, and glyph-ink path resolution via the shared
TrueTypeFont/SystemFontCatalog primitives
(VsdxDocument.TextLayout.cs, VsdxTextLayout.cs). A standalone glyph
painter (VsdxDocument.TextRender.cs) is included but intentionally
left unwired from any public API.
- VsdxShapeNode now carries resolved text runs, text-box transform, and
text layout alongside the existing geometry/paint data.
Adds VsdxTextParsingTests, VsdxTextStyleTests,
VsdxTextBoxPositioningTests, VsdxTextLayoutTests, VsdxTextRenderTests,
and VsdxFixtureTextResolutionTests (real-fixture coverage), growing the
Vsdx test suite from 201 to 297 passing tests.
Deferred to later milestones: connectors/glue-points and group/nested-
shape recursive composition (Milestone 5/6), themes (Milestone 6), and
the public Render API / pixel painting to a Surface (Milestone 7).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 5: connector/glue-point routing
Implements connector endpoint resolution and arrowhead rendering support
for DemaConsulting.CanvasNet.Vsdx, per the 9-milestone VSDX plan.
- Parse <Connects> sections per page into VsdxConnect records (connector
shape ID, endpoint, target shape ID, target cell, connection-point
index), associating connector shapes with their glued targets for
future use (e.g. hit-testing). Dangling/unresolved targets are
tolerated, not thrown.
- Endpoint-resolution strategy CONFIRMED against real fixture evidence:
trust the pre-baked BeginX/BeginY/EndX/EndY V= cell values already
resolved by Milestone 3's 1-D transform path, rather than dynamically
re-solving glue-point geometry. Verified across three real connector
fixtures (davehoward-test4-connectors.vsdx, jgreywolfvsdxjs-connectors.vsdx,
jgreywolfvsdxjs-diagramwithstyles.vsdx): every connector's Begin/End
cells carry a literal numeric V even when F= is a formula such as
_WALKGLUE(...) or PAR(PNT(...)), matching the format reference's
guidance that Visio bakes current glue coordinates at save time.
- Resolve BeginArrow/EndArrow/BeginArrowSize/EndArrowSize cells through
the existing StyleSheet-chain-then-direct-override precedence
(reusing the line-cell resolver), producing a VsdxArrowhead
descriptor (style + size) per endpoint. Implemented a conservative
style subset (None/OpenArrow/Arrow/Stealth/Circle/Diamond) with
graceful degrade-to-None for any unrecognized or non-numeric index,
never throwing. A real fixture (BeginArrow=13) exercises this
degrade path directly.
- New resolved-connector model types: VsdxConnect, VsdxConnectEndpoint,
VsdxConnectorEndpoints, VsdxArrowhead, VsdxArrowheadStyle. Wired into
VsdxShapeNode (Connects, ConnectorEndpoints) and VsdxResolvedPaint
(BeginArrowhead, EndArrowhead). Still no pixel painting to Surface.
- Added VsdxDocument.Connects.cs and VsdxDocument.Arrowheads.cs
following the existing partial-class-per-concern convention.
- Tests: VsdxConnectsParsingTests, VsdxGluePointResolutionTests,
VsdxArrowheadResolutionTests, VsdxConnectorFixtureTests (+20 tests;
297 -> 357 aggregated across net8.0/net9.0/net10.0, all green).
- Updated docs/reqstream/canvas-net-vsdx/vsdx-document.yaml wording for
ArrowheadRendering to reflect degrade-never-throw behavior.
Deferred to later milestones: group/nested-shape recursion and
theme/built-in-palette resolution (Milestone 6); public Render API and
pixel painting of resolved connectors/arrowheads to Surface
(Milestone 7).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 6: Theme color resolution and group/nested-shape transform composition
- Add VsdxTheme / VsdxDocument.Theme.cs: lazy, non-throwing parsing of visio/theme/themeN.xml
color scheme (12 RGBA slots), with graceful fallback when no theme part is present.
- Wire THEMEVAL(slot)-style cell formulas into the existing color resolution pipeline
(VsdxColorPalette.cs, VsdxDocument.Paint.cs, VsdxDocument.Styles.cs) alongside the
existing explicit RGB and FillPattern 0/1 paths.
- Add VsdxDocument.Groups.cs: recursive <Shapes> group/nested-shape resolver that composes
each child shape's local transform with its parent group's transform to arbitrary nesting
depth, with a depth-budget and resolved-shape-count guard throwing InvalidDataException on
pathological/cyclic structures.
- Extend VsdxShapeNode with a Parent reference to support the composed shape tree; rewire
VsdxDocument.Shapes.cs to use the new recursive resolver.
- Add VsdxThemeResolutionTests.cs and VsdxGroupResolutionTests.cs, grounded in real fixtures
(jgreywolfvsdxjs-* for theme parts, davehoward-test10-nested-shapes.vsdx and
davehoward-test3-house.vsdx for group nesting / Master-driven group children), plus
synthetic tests for the no-theme fallback, canonical theme-slot resolution, and the
depth/count budget exception paths that are unreachable via any real fixture.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 7: Public Render API integration
Implement VsdxDocument.Render(...) public API: page-indexed rendering to
a Surface via width/height and DPI overloads, with VsdxRenderOptions for
background color control (default opaque white). Walk the resolved
shape tree (including nested groups from Milestone 6) in document
order, accumulating page-to-pixel coordinate transforms via the new
VsdxShapeTransform.ToPageMatrix(), and dispatch each shape to geometry
fill/stroke painting (Milestone 3), text layout painting via
PaintTextLayout (Milestone 4, now wired in for the first time), and
connector line + arrowhead painting (Milestone 5) using the new
VsdxArrowheadGeometry local-space arrowhead builder.
Add end-to-end rendering regression tests covering shape-only, text,
connector, and group fixtures, plus synthetic unit tests for argument
validation, background defaults, DPI consistency, document-order
z-ordering, lazy shape-tree caching, and arrowhead painting. Link test
coverage to the pre-registered reqstream requirement IDs for the public
render API.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 8: promote Vsdx fixtures into test project
Move the 14 .vsdx fixtures, README.md, and the two LICENSE files out of
the test/DemaConsulting.CanvasNet.Vsdx.Tests.Fixtures-STAGING staging
folder into an in-project test/DemaConsulting.CanvasNet.Vsdx.Tests/VsdxFixtures
folder, mirroring the sibling Pptx package's PptxFixtures convention
exactly. Update the Vsdx test project's .csproj to use the same bare
<None Include="VsdxFixtures\**"> item form as Pptx, remove the
Staging Note section from the moved README.md, and update
.reviewmark.yaml's stale STAGING path reference on the
CanvasNetVsdx-VsdxDocument review-set. The STAGING folder is deleted
entirely now that all fixture-dependent tests pass from the new
location (confirmed: AppContext.BaseDirectory-based fixture resolution
required no code changes).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 8: backfill reqstream traceability, verification docs, and coverage gap tests
Reqstream traceability backfill (docs/reqstream/canvas-net-vsdx.yaml and
docs/reqstream/canvas-net-vsdx/vsdx-document.yaml): fix the drifted
tests: entries so every requirement ID references a real,
namespace-qualified, currently-passing test method name. Correct
requirement text for FillPatternDeferral (CanvasNetVsdx-ColorFill /
CanvasNetVsdx-VsdxDocument-FillPatternDeferral): the originally-planned
behavior (throw VsdxUnsupportedFeatureException on unsupported fill
patterns) was never implemented; the actual, already-approved behavior
is graceful degradation to solid fill, and the requirement text/title
now describe that - no new exception type was implemented (that would
be scope creep).
Two additional drift corrections discovered while writing this
milestone's own test coverage (documentation-only, no production code
changed, analogous to and consistent with the plan-authorized
FillPatternDeferral fix):
- GeometryUnrecognizedRowSkip: EllipticalArcTo/NURBSTo were claimed to
convert to approximating Bezier path segments; they are actually
skipped like any other unrecognized geometry row.
- ColorTableResolution: a document-level Colors/FaceNames table was
claimed to be parsed and resolved against; no such element is parsed
anywhere in VsdxDocument's source.
Both docs/design/canvas-net-vsdx.md and
docs/design/canvas-net-vsdx/vsdx-document.md are corrected to match,
each with a 'Correction note (Milestone 8)' annotation.
Verification documentation: replace the TODO stubs in
docs/verification/canvas-net-vsdx.md (system-level, 25 scenario
subsections) and docs/verification/canvas-net-vsdx/vsdx-document.md
(unit-level, 35 requirement-keyed subsections) with real test-strategy,
coverage-summary, and traceability content, mirroring the Pptx
sibling's structure and level of detail.
New test/DemaConsulting.CanvasNet.Vsdx.Tests/VsdxSystemIntegrationTests.cs:
25 test methods (24 Fact + 1 Theory over all 14 real fixtures), one per
system-level requirement, mirroring PptxSystemIntegrationTests.cs's
pattern, including a true end-to-end render-every-page-of-a-real-fixture
scenario.
Close the 5 concrete coverage gaps identified in the plan:
- Master-resolution caching (VsdxMasterInheritanceTests.cs)
- EllipticalArcTo/NURBSTo geometry rows skip tolerantly
(VsdxGeometryTests.cs)
- Geometry-row replace-by-IX merge semantics
(VsdxMasterInheritanceTests.cs)
- StyleSheet ID-0 ('No Style') chain termination
(VsdxStyleResolutionTests.cs)
- Color-table resolution: built-in palette index and direct hex literal
(new VsdxColorPaletteTests.cs)
Narrow, documented source change: VsdxDocument.Masters.cs's
ResolveMasterShape changed from private to internal (zero behavior
change) solely to allow the new caching-coverage test to call it
directly and assert the parsed master content tree is reused by
reference across repeated resolutions.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 9: final local review and documentation reconciliation
- Removed stale STAGING fixture-path reference in the vsdx-document.sysml
comment (pre-dated Milestone 1; test fixtures were promoted out of staging
in Milestone 8).
- Reconciled docs/sysml2/model/canvas-net-vsdx.sysml and its vsdx-document
subfolder descriptive text with the Milestone 8 design-doc corrections:
no document-level <Colors>/<FaceNames> table is parsed (only the built-in
palette, literal hex, and the Themed sentinel), EllipticalArcTo/NURBSTo/
InfiniteLine rows are tolerantly skipped rather than resolved into Path
segments, and no Drawing.Gradient type is referenced (every non-solid
FillPattern degrades to solid fill).
- Refreshed the vsdx-document.sysml sourceRef/testRef comments from a stale
pre-implementation planning-skeleton file list to the actual, current
source/test file layout.
- Refreshed the CanvasNetVsdx-VsdxDocument .reviewmark.yaml path comments
from '(planned; not yet created)' to match the completed implementation.
- Added a DemaConsulting.CanvasNet.Vsdx Features bullet and Installation
section to README.md, mirroring the existing Svg/Pdf/Charts/Pptx entries
(previously absent despite the package being fully implemented).
Full-repo validation: pwsh ./build.ps1 (11,127/11,127 tests passing across
net8.0/net9.0/net10.0) and pwsh ./lint.ps1 (markdownlint-cli2, cspell,
yamllint, dotnet format, reqstream, versionmark, reviewmark, sysml2tools)
both exit 0. dotnet reviewmark --enforce passes with no required-review
violations; the Vsdx-document review set's remaining coverage-warning gap
(*.Tests.csproj project file) is a pre-existing, repo-wide pattern shared
by every sibling test project, not a Vsdx-specific gap, and is left
untouched per scope discipline. An independent code-review pass over the
full src/DemaConsulting.CanvasNet.Vsdx and
test/DemaConsulting.CanvasNet.Vsdx.Tests diff (range 1b97b3e..HEAD) found
no defects: exception contracts, geometry/transform math, Master/StyleSheet
resolution, group-recursion budgets, resource disposal, thread-safety, and
public-API XML-doc coverage were all confirmed consistent with the
documented design.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 10: Bug #1 - exclude deleted shape stubs and suppress NonPrinting self-paint
Fixes two distinct root causes of spurious/duplicate text confirmed against
the apache/poi test-data corpus's real-world fixtures, verified visually
against Visio COM reference PNGs via the external smoke-test harness:
- VsdxDocument.Shapes.cs: ParseShapeElements now excludes a group child
<Shape Del="1"> stub (shape-level deletion, distinct from the already-
handled row-level geometry Del marker) from the resolved shape tree.
Confirmed, via a controlled git-stash A/B pixel diff, to eliminate
60973.vsdx's duplicate "OOB: N/A"/"[B] Lo1: N/A"/"TS: N/A" placeholder
text.
- VsdxDocument.Render.cs: RenderShapeRecursive now skips a shape's own
self-paint (fill/stroke/text/arrowheads) when its effective NonPrinting
cell resolves true, while still recursing into its children. Confirmed
to eliminate 44501b.vsdx's spurious "Activity" heading.
Adds VsdxDocument_GroupChildDeletedStub_ExcludedFromResolvedShapeTree to
VsdxGroupResolutionTests.cs covering the Del-stub exclusion with a small
synthetic fixture (the NonPrinting-suppression test rides along with
Bug #2's commit in VsdxRenderFixtureTests.cs, since both new tests were
appended as one contiguous diff hunk).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 10: Bug #2 - visible hairline stroke floor plus transform-cell merge fix for missing connector lines
Fixes 60973.vsdx's missing connector-line defect, confirmed via the
external smoke-test harness against the Visio COM reference PNG. This
required two complementary changes beyond the plan report's original
stroke-width-only diagnosis, discovered via root-cause iteration after
the stroke-width floor alone did not resolve the visual discrepancy:
- VsdxDocument.Render.cs: PaintShapeGeometry's PaintStroke call now
applies a MinStrokeWidthPixels = 1f floor to the resolved stroke width,
so a sub-pixel LineWeight (confirmed ~0.5px at 150 DPI on this
fixture's connectors) still rasterizes a visible hairline instead of
vanishing.
- VsdxDocument.CellMerge.cs: discovered during deeper root-cause
investigation that the generic Master-wins merge rule was also
collapsing connector shape 802's resolved position to its Master's
own small, unrelated template-local corner, because its own correct,
baked PinX/PinY/LocPinX/LocPinY cells were marked F="Inh". Adds
TransformCellNames/PreferInstanceTransformCells so an instance's own
cell for the nine transform cells (PinX/PinY/Width/Height/LocPinX/
LocPinY/Angle/FlipX/FlipY) always wins over the Master's same-named
cell, even when marked Inh - narrowly scoped to exactly these cells,
since every other (genuinely shared) style cell keeps the original
Master-wins-over-Inh rule.
Adds MasterInheritance_InstanceInhMarkedTransformCell_PreferredOverMasterValue
and MasterInheritance_InstanceInhMarkedNonTransformCell_StillDefersToMasterValue
to VsdxMasterInheritanceTests.cs, and Render_SubPixelLineWeight_StillPaintsVisibleHairlineStroke
plus Render_NonPrintingShape_SkipsOwnFillButStillRendersChildren (Bug #1(b)'s
own test, appended in the same diff hunk) to VsdxRenderFixtureTests.cs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 10: Bug #3 - honor FillForegndTrans/LineColorTrans transparency cells
Fixes 60973.vsdx's "Virtual Devices" container rendering fully opaque and
obscuring its own children, confirmed via the external smoke-test harness
against the Visio COM reference PNG.
VsdxDocument.Paint.cs's ResolvePaint now resolves FillForegndTrans/
LineColorTrans through the same FillStyle/LineStyle StyleSheet chain
already used for FillForegnd/LineColor, and a new ApplyTransparency
helper modulates the resolved FillColor/StrokeColor's alpha channel by
the parsed 0..1 transparency fraction. Confirmed via direct pixel
sampling: the container's resolved fill (127,127,127,153) blends to
(178,178,178) over white, matching the rasterizer's own alpha
compositing and the reference PNG's lighter, mostly-see-through frame.
Adds StyleResolution_FillForegndTrans_ReducesResolvedFillAlpha and
StyleResolution_LineColorTrans_ReducesResolvedStrokeAlpha to
VsdxStyleResolutionTests.cs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 10: companion documentation for the 3 rendering-fidelity fixes
Updates the companion design/requirements/verification artifacts for this
milestone's 3 code fixes plus one doc-only note, per the originating plan
report's companion-artifact table:
- docs/design/canvas-net-vsdx/vsdx-document.md: documents the shape-level
Del="1" exclusion, the NonPrinting self-paint suppression, the stroke
hairline floor, the *Trans alpha resolution, and the CellMerge.cs
transform-cell-preference refinement discovered during this milestone's
own Bug #2 root-cause investigation (a deviation beyond the plan
report's original stroke-width-only diagnosis).
- docs/design/canvas-net-vsdx.md: records test.vsdx's header-bar/star as
a confirmed real-world sample of the already-documented Themed
neutral-fallback limitation - a documentation-only addition, no code
change, per the plan report's own non-bug determination.
- docs/reqstream/canvas-net-vsdx/vsdx-document.yaml: adds requirement
entries for deleted-shape exclusion, NonPrinting suppression, the
minimum visible stroke width, transparency honoring, and extends the
existing CellMerge requirement for the transform-cell exception.
- docs/verification/canvas-net-vsdx/vsdx-document.md: adds verification
entries for all 5 new/extended behaviors, tracing to their new unit
tests and to the external smoke-test visual-comparison evidence.
- .cspell.yaml: adds 'unconsulted', a genuine technical term (following
this file's own existing un-prefixed-word precedent) needed by the new
design/reqstream/verification prose and VsdxDocument.Paint.cs's own
ApplyTransparency remarks.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* vsdx milestone10 retry1: narrow CellMerge transform-cell exception to 1-D shapes (Finding #3)
Scope the PreferInstanceTransformCells exception in VsdxDocument.CellMerge.cs to
1-D (connector) shapes only, reusing the existing BeginX/EndX detection
convention from VsdxDocument.Groups.cs, rather than applying it to every
shape type including 2-D shapes where the Master's own value can be
legitimately inherited.
- Updated the existing 1-D test fixture
(MasterInheritance_InstanceInhMarkedTransformCell_PreferredOverMasterValue)
to include BeginX/BeginY/EndX/EndY cells so it still exercises the
narrowed 1-D-only code path correctly.
- Added MasterInheritance_2DShapeInhMarkedTransformCell_DefersToMasterValue
proving a legitimate 2-D Master-inheritance-of-position scenario still
resolves correctly post-guard.
- Restored 2 assertions silently dropped from
MasterInheritance_InstanceGeometryRowWithoutDel_ReplacesMasterRowAtMatchingIndex
in a prior milestone 10 commit (Finding #4).
- Re-verified via smoke-test harness that 60973.vsdx's connector lines
(Bug #2 fix) are unaffected by the narrowing.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* vsdx milestone10 retry1: add full-transparency locking tests (Finding #1)
Independently re-verified quality's claimed github260.vsdx visual
regression (a LineColorTrans="1" shape allegedly losing a border shown by
the Visio reference) by pixel-scanning the actual Visio-reference PNG at
the shape's own bounding box: no border/stroke ring exists in the
reference at all - it is a pure, borderless fill. The current invisible
rendering of that shape is caused by an unrelated, already-documented
NURBS-skip geometry limitation (confirmed via raw XML inspection and via
'git show f9c46f9 --stat', which touched only Paint.cs), not by the Bug #3
transparency fix.
No code change was made to VsdxDocument.Paint.cs. Added
StyleResolution_LineColorTrans_FullyTransparent_HasNoVisibleStroke and
StyleResolution_FillForegndTrans_FullyTransparent_HasNoVisibleFill to lock
in the existing, re-verified-correct V="1" (fully transparent) behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* vsdx milestone10 retry1: correct documentation for Findings #1-#3 (docs)
- docs/design/canvas-net-vsdx/vsdx-document.md: document the 1-D-only
scoping of the CellMerge transform-cell exception (Finding #3), add the
Finding #1 re-verification note to the transparency resolution
narrative, and clarify the Del="1" stub-exclusion fix addresses the
stale-stub clutter text only, not the AIRttt/AIRuuu defect (Finding #2).
- docs/design/canvas-net-vsdx.md: cite github260.vsdx's circle as a second
confirmed instance of the NURBS-skip limitation, and add a new, named
deferred-limitation bullet documenting the AIRttt/AIRuuu defect as a
distinct, pre-existing, out-of-scope issue (Finding #2).
- docs/reqstream/canvas-net-vsdx/vsdx-document.yaml: update the CellMerge
entry's title/justification/tests for the 1-D-only scope, update the
TransparencyResolution entry's justification/tests with the Finding #1
re-verification evidence, and clarify the DeletedShapeExclusion entry's
justification to distinguish the Del="1" fix from the AIRttt/AIRuuu
defect.
- docs/verification/canvas-net-vsdx/vsdx-document.md: mirror the same
scope corrections and new test-scenario names in the verification
narrative for CellMerge, DeletedShapeExclusion, and
TransparencyResolution.
- .cspell.yaml: add genuine proper nouns/fixture identifiers surfaced by
the above documentation (AIRttt, AIRuuu, Lucidchart, lucidchart,
borderless) so `lint.ps1` passes cleanly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 11: cell-by-cell geometry-row merge (Group A: Findings #2, #3-frame contribution)
Fixes MergeGeometryRows (VsdxDocument.CellMerge.cs) to merge a matched instance/Master geometry
row cell-by-cell instead of whole-row replacement, so an instance row overriding only a subset
of its own cells still inherits the Master row's other, un-overridden cell values rather than
collapsing them to CLR defaults.
Adds MasterInheritance_GeometryRowPartialOverride_MergesCellByCellNotWholesale regression test.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 11: EllipticalArcTo/ArcTo geometry conversion (Group B: Finding #1)
Adds EllipticalArcTo (general ellipse/arc) and ArcTo (circular, bow-height-derived) geometry-row
conversion to VsdxDocument.Geometry.cs's ResolveGeometry, producing an ArcTo path command that
reaches the row's own destination point instead of tolerantly skipping the row. A zero-bow ArcTo
row (A=0) degrades to a plain LineTo rather than throwing or producing a degenerate zero-radius
arc.
Adds Geometry_EllipticalArcToRow_ConvertsToArcReachingDestination,
Geometry_ArcToRow_ConvertsToArcWithBowDerivedRadius, and
Geometry_ArcToRow_ZeroBow_DegradesToLineTo, replacing the now-outdated
Geometry_EllipticalArcToAndNurbsToRows_AreSkippedWithoutThrowing test.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 11: HideText suppression (Group C: Finding #8)
Adds HideText cell resolution (VsdxDocument.Paint.cs) and consults it in VsdxDocument.Render.cs
to skip only a shape's own text-run paint when HideText resolves truthy, leaving its own
fill/stroke/arrowheads and its children's painting unaffected - distinct from the broader
NonPrinting suppression which also skips fill/stroke.
Adds Render_ShapeWithHideTextCell_SuppressesOwnTextButNotFillOrStroke regression test.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 11: fld element text parsing (Group D: Finding #3 label sub-symptom)
Adds a <fld> (Field reference) element case to BuildRawRuns (VsdxDocument.Text.cs) so a field's
own nested, save-time-cached text content is parsed as a literal run instead of being silently
dropped; a <fld> interleaved between plain text segments merges into the surrounding run exactly
like a plain XText node would.
Adds TextParsing_FldElement_NestedTextContentParsedAsLiteralRun and
TextParsing_FldElementInterleavedWithText_MergesIntoSurroundingRun regression tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 11: arrowhead index 4/254 mapping (Group E: Finding #5)
Maps confirmed-in-use arrowhead index 254 to a new hollow/unfilled-triangle VsdxArrowheadStyle
(VsdxArrowhead.cs, VsdxArrowheadGeometry.cs, VsdxDocument.Arrowheads.cs), found via a full-
document scan of the poi-fixtures corpus, and adds coverage for index 4 (existing solid-arrow
style family). Index 254 previously silently degraded to the unrecognized-index plain-line-end
fallback.
Adds ArrowheadResolution_EndArrowIndex4_ResolvesToArrowStyle and
ArrowheadResolution_EndArrowIndex254_ResolvesToHollowTriangleStyle regression tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Vsdx Milestone 11: companion documentation updates for 5 real-world fixes
Updates design docs (canvas-net-vsdx.md, canvas-net-vsdx/vsdx-document.md), reqstream
requirements (vsdx-document.yaml), verification entries (vsdx-document.md), and the sysml2
model (vsdx-document.sysml) to document:
- EllipticalArcTo/ArcTo geometry conversion (new ArcGeometryResolution requirement)
- cell-by-cell geometry-row merge correction (GeometryRowMerge)
- fld element text parsing (TextRunParsing)
- arrowhead index 4/254 mapping (ArrowheadRendering)
- HideText suppression (new HideTextSuppression requirement)
Also documents, as confirmed-but-deferred limitations (no code change):
- the shared 2-D shape transform-cell-merge-exclusion root cause behind Findings #3's frame/
label and #6's residual text-overlap symptoms
- Finding #4's partial-fix nuance (triangle/bar shape fixed; unrelated pre-existing text-overlap
position defect persists)
- Finding #5's arrowhead-size-proportional-to-stroke-width caveat as a pre-existing, unchanged
design limitation
- a second confirmed real-world instance of the documented neutral-theme-fallback limitation
(60973.vsdx's Nwwww/Neeeee rack-slot bars)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(vsdx): unconditionally overlay instance geometry-row cells over Master merge
Milestone 11 quality-retry (retry 1): fixes a confirmed geometry-row
cell-merge regression that fused/mis-sized ellipses in 60489.vsdx (Shape
114/122) and produced a floating, mispositioned, wrong-colored triangle in
44501e.vsdx (Shape 64, Master 28). Root cause: MergeGeometryRow applied the
generic "instance literal wins, else Master's cell" rule to geometry-row
coordinate cells, but these are almost always cached as F="Inh"
(formula-derived from Width/Height), so the generic rule treated them as
absent and substituted the Master's own differently-scaled cached value.
Fix: generalize PreferInstanceTransformCells to PreferInstanceCells(merged,
instanceCells, names), add an ArrowCellNames array (BeginArrow/EndArrow/
BeginArrowSize/EndArrowSize) applied through the existing 1-D-only gate
alongside TransformCellNames, and have MergeGeometryRow unconditionally
overlay the instance row's own present cells (literal or Inh) over the
generic merge result, preserving Master fallback only for cells genuinely
absent from the instance row.
While adding regression coverage for the ArrowCellNames extension, a new
test caught that PreferInstanceCells's original design (swapping which
VsdxCell wins, preserving its Formula) silently failed to affect arrowhead
resolution at all when overlaying an Inh-marked cell: ResolveLineCellValue/
ResolveFillCellValue (VsdxDocument.Paint.cs) use TryGetLiteral, which treats
any Inh-marked cell as "defer to the StyleSheet chain" rather than an
override. Fixed by writing the overlaid cell back as a literal
(Formula: null) - confirmed safe for TransformCellNames too, since its
consumer never inspects Formula.
Investigated the related arrowhead-rendering quality finding (44501e.vsdx
page 1) against the real fixture: the floating triangle is the same
geometry-row regression (fixed above); the separate "dash stub" artifacts
are a pre-existing, deliberate architecture boundary (arrowhead-decoration
painting is gated on 1-D ConnectorEndpoints; the dash-producing shapes are
ordinary 2-D Shape-typed icons) - an accepted, out-of-scope limitation, not
force-fixed.
Added regression tests:
- MasterInheritance_GeometryRowAllCellsInhButInstanceSizeDiffers_InstanceCoordinatesWin
- MasterInheritance_GeometryRowCellGenuinelyAbsentOnInstance_StillFallsThroughToMaster
- ArrowheadResolution_InstanceInhMarkedArrowCell_PreferredOverMasterValue
- ArrowheadResolution_2DShapeInhMarkedArrowCell_DefersToMasterValue
Verified via the external smoke-test harness: 60489.vsdx page 0 now renders
two distinct, correctly-sized ellipses; 44501e.vsdx page 1 no longer shows
the floating triangle and continues to render the EndArrow=254 hollow
triangle correctly; no regressions in 44501d.vsdx, 44501a.vsdx, 60973.vsdx
(pages 0-3), test.vsdx, and github260.vsdx.
dotnet build CanvasNet.slnx: 0 warnings, 0 errors.
Vsdx test project: 657/657 passed.
Full solution: 11193/11193 passed.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs(vsdx): update companion docs for Milestone 11 quality-retry (retry 1)
Updates the reqstream YAML, design docs, and verification doc to match the
actual, evidence-based outcome of this quality-retry cycle rather than the
plan's hypothesis:
- GeometryRowMerge: corrected wording to the verified unconditional-overlay
rule; cites both the 60489.vsdx ellipse and 44501e.vsdx Shape-64 triangle
evidence; lists the 2 new geometry regression tests.
- CellMerge: documents the ArrowCellNames generalization and the
literalization fix discovered via testing; lists the 2 new arrow
regression tests.
- ArrowheadRendering: documents the investigation's conclusion - the
floating triangle is fixed via the geometry-row fix; the dash-stub
artifacts are characterized as an accepted, pre-existing, out-of-scope
1-D-only rendering-architecture limitation, not a regression and not
force-fixed. No requirement scope change.
docs/design/canvas-net-vsdx.md gains a new "Milestone 11's quality-retry
cycle (retry 1)" list entry; docs/design/canvas-net-vsdx/vsdx-document.md
corrects the geometry-row-merge cell-by-cell description and documents the
fix's rationale; docs/verification/canvas-net-vsdx/vsdx-document.md adds
matching verification notes with before/after visual-confirmation evidence
for GeometryRowMerge, CellMerge, and ArrowheadRendering.
pwsh ./fix.ps1 and pwsh ./lint.ps1 both ran clean after these changes.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix 2-D group-child transform-cell merge gap (Milestone 12 Finding #3)
MergeCells now applies the TransformCellNames (PinX/PinY/Width/Height/
LocPinX/LocPinY/Angle/FlipX/FlipY) instance-wins overlay when the merged
shape is a Group child (isGroupChild: parent is not null), independent of
the existing 1-D-only test. This fixes a stale Master template-default
transform cell incorrectly winning over a resized Group child instance's
own correct, F="Inh"-marked value.
Confirmed via the external smoke-test harness against the real-world
corpus: Test_Visio-Some_Random_Text.vsdx's "View" table shape no longer
over-wraps its text (TxtWidth no longer falls back to a stale Master
Width), test.vsdx's header bar now sits flush at the top of its group,
and 44501e.vsdx's "-has" connector label now resolves to its own correct
external position. The top-level (non-group-child) 2-D shape exclusion
is untouched and remains locked by
MasterInheritance_2DShapeInhMarkedTransformCell_DefersToMasterValue.
Adds synthetic-fixture tests:
- MasterInheritance_2DGroupChildInhMarkedTransformCell_PrefersInstanceValue
- TextBox_GroupChildInhMarkedWidthDiffersFromMaster_TxtWidthReflectsInstanceWidth
- TextLayout_CorrectedGroupChildWidth_FitsOneLineWhereStaleMasterWidthOverWrapped
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Document Milestone 12 group-child cell-merge fix and corpus findings
docs/design/canvas-net-vsdx.md: revise the Milestone 11 "2-D shape
transform-cell-merge exclusion" deferred-limitation bullet to record it
is now fixed for the group-child case, while 60973.vsdx's rack-frame
remains invisible for a separate, already-documented Themed-color/
gradient-fill reason, not a transform-cell problem. Adds a new bullet
extending the Milestone 4 neutral-theme-fallback deferral with this
milestone's exhaustive cross-fixture Themed-color investigation
(test_text_extraction.vsdx/60489.vsdx needing unfilled vs. 60973.vsdx
needing filled with real theme colors; no safe discriminator found).
Documents Finding #5 (UML class-name text crowding the compartment's own
top border in 44501d.vsdx/44501e.vsdx) as deferred/unresolved with
precise follow-up scope.
docs/verification/canvas-net-vsdx/vsdx-document.md and
docs/reqstream/canvas-net-vsdx/vsdx-document.yaml: update the
CanvasNetVsdx-VsdxDocument-CellMerge requirement/verification entry to
describe the group-child transform-cell carve-out, list the new tests,
and record the real-world-corpus confirmation evidence.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Strengthen HideText suppression test to scan full rect for glyph ink
Code review flagged that Render_ShapeWithHideTextCell_SuppressesOwnTextButNotFillOrStroke
only sampled a single interior pixel, which would still pass even if the
HideText suppression were removed entirely. Now scans every pixel in the
shape's full rendered bounds and asserts each matches the pure fill color,
proving no glyph ink was painted anywhere.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs: fix formal-review traceability/documentation gaps for Vsdx
Addresses all Critical/High/Medium findings (and one trivial Low) from the
7 formal-review reports run against the Vsdx work on this branch. No C#
production source behavior changes; one new unit test added to close a
coverage gap, plus a cspell-ignore fix in an existing test file.
Purpose review (F9, High):
- Add a full `VsdxDocument` User Guide API Reference section and a new
`Example 16` to docs/user_guide/introduction.md, mirroring the existing
PdfDocument section structure/tone.
Decomposition review (DES-01/DES-02):
- Reword the self-contradictory ChartModel unit-count sentence in
docs/design/introduction.md (two units, not "a single unit... and a
ChartRenderer unit").
- Add the missing CanvasNetVsdxView.svg diagram embed to
docs/design/canvas-net-vsdx/vsdx-document.md.
CanvasNetVsdx-Architecture review (DES-02, High):
- Add CanvasNetVsdx to docs/design/introduction.md's Software Structure and
Folder Layout sections.
- Document 6 existing unit tests (geometry, group-resolution, style,
render) as system-level Test Scenario coverage for the Milestone 10/11
capabilities in docs/verification/canvas-net-vsdx.md, since they already
exercise the full public API end-to-end.
CanvasNetVsdx-Design review:
- Link the 6 orphaned Milestone 10/11 unit requirements under their system
parent requirements in docs/reqstream/canvas-net-vsdx.yaml (arc-geometry
resolution, deleted-shape exclusion, transparency resolution,
non-printing suppression, minimum stroke width, hide-text suppression).
- Fix the broken MasterShapeInheritance -> CellMerge cross-references and
the stale "unimplemented"/planning-skeleton header comment in
docs/reqstream/canvas-net-vsdx/vsdx-document.yaml.
CanvasNetVsdx-Verification review:
- Add the missing Acceptance Criteria section to
docs/verification/canvas-net-vsdx/vsdx-document.md.
- Add CanvasNetVsdx to docs/verification/introduction.md's Scope section.
- Correct the stale "EllipticalArcTo is never converted" claim in
docs/verification/canvas-net-vsdx.md (Milestone 11 implemented real
elliptical-arc geometry resolution).
CanvasNetVsdx-AllRequirements review:
- Covered by the same reqstream/vsdx-document.yaml fixes above.
CanvasNetVsdx-VsdxDocument review (F-1 Medium, F-2/F-3 Low):
- Update docs/design/canvas-net-vsdx/vsdx-document.md's Key Methods entry
for ResolveEffectiveShape/CellMerge to describe the Milestone 12
isGroupChild carve-out, and the Data Model section to describe the
Milestone 11 arrowhead-index 4/254 recognition.
- Add a regression test
(ArrowheadResolution_2DGroupChildInhMarkedArrowCell_DefersToMasterValue)
proving the isGroupChild carve-out is deliberately scoped away from
ArrowCellNames, closing the F-3 coverage gap.
Verified clean with `pwsh ./lint.ps1` (markdownlint, cspell, yamllint,
reqstream, versionmark, reviewmark, sysml2tools) and a full
`pwsh ./build.ps1` run (11,205 tests passed, 0 failed, 0 skipped).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix PR #42 review comments: multi-section fill/line flags, rotation-invariant scale, TxtAngle text rotation, exception accessibility, stale docs, and ApiMark bump
Addresses all 8 GitHub Copilot automated review findings on PR #42:
1. VsdxDocument.Paint.cs: ResolvePaint no longer derives shape-wide HasFill/HasLine
from only geometry section 0's NoFill/NoLine; shape-wide flags now come purely
from FillPattern/LinePattern, with per-section suppression handled exclusively
by PaintShapeGeometry's existing per-section check. Regression test added.
2. VsdxDocument.Render.cs: AverageScale now computes the lengths of the transformed
basis vectors instead of the raw matrix diagonal, making it rotation-invariant.
Regression test compares stroke thickness of a rotated vs unrotated line.
3. VsdxDocument.Render.cs/TextLayout.cs/VsdxTextBoxTransform.cs: TxtAngle is now
composed into a dedicated text-to-pixel transform (ResolveTextToPixelTransform)
applied at paint time, rotating the text box about its own pin - a contained,
low-risk fix (approach a). Added a direct unit test of the composed transform.
4. VsdxUnsupportedFeatureException.cs: made public (was internal) to match its own
documented "callers can distinguish unsupported features" contract and the
sibling PptxUnsupportedFeatureException's public convention. Confirmed via
repo-wide search it has zero throw-sites today; kept (not removed) since
existing approved docs already describe it as intentional future scaffolding.
5. docs/sysml2/model/canvas-net-vsdx.sysml: corrected stale row-support list -
EllipticalArcTo/ArcTo are implemented (Milestone 11, resolved into real ArcTo
path commands); only NURBSTo/InfiniteLine/RelCubBezTo/SplineStart/SplineKnot/
PolylineTo/Ellipse remain genuinely skipped/deferred.
6. docs/sysml2/model/canvas-net-vsdx/vsdx-document.sysml: corrected stale claim
that Foreign shapes and non-solid FillPattern values throw
VsdxUnsupportedFeatureException - non-solid fills degrade to solid, and
Foreign shapes have no distinct Type-based handling at all.
7. VsdxDocument.cs: rewrote the class's stale Milestone-2-era XML remarks (which
claimed no shape/geometry/style/text/connector parsing existed) to accurately
describe current capabilities, mirroring PptxDocument's remarks style/tone.
Also corrected a stale "deferred to Milestone 7" remark on VsdxTextLayout.
8. VsdxTextStyleTests.cs: strengthened the VerticalAlign/margin test, which
previously only asserted TextLayout was non-null, to assert the resolved
glyph's actual X/Y origin differs measurably between the StyleSheet-inherited
default and a shape's own overriding VerticalAlign/LeftMargin cells.
Also bumps DemaConsulting.ApiMark.MSBuild to 0.5.7 across every package in the
repo (previously an inconsistent mix of 0.5.1/0.5.4/0.5.4 on Vsdx) - 0.5.7 picks
up fixes for cref link resolution and type-only cref rendering between 0.5.4 and
0.5.7 that are directly relevant to this repo's heavy XML-doc <see cref> usage.
Full solution build and all 11214 tests pass; lint.ps1 exits 0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix PR #42 review round 2 findings (7 Copilot review comments + 2 formal-review recheck doc gaps)
Addresses all 7 findings from GitHub Copilot's automated review round 2 on
PR #42 (after commit f6e3cf0 fixed the first 8), plus 2 additional
doc-propagation gaps found by a formal-review recheck of that same commit.
1. (High) VsdxDocument.Shapes.cs: ParseShapeElement/ParseShapeElements now
enforce the same MaxGroupNestingDepth/MaxResolvedShapeCount budget during
the parse pass itself (not only during ResolveShapeRecursive), so a
deeply nested or very wide untrusted page/master can no longer exhaust
the call stack or memory before either safety budget is reached. Added
direct ParseShapeElement unit tests (bypassing the resolver entirely) for
both the depth and count budgets.
2. (Medium) VsdxDocument.Groups.cs / VsdxTextRun.cs / VsdxDocument.Text.cs:
added VsdxRawText.HasElement so an explicit, empty <Text/> element is
distinguished from a genuinely absent one; the Master-text fallback now
checks HasElement instead of Runs.Count, so an instance's intentional
empty <Text/> no longer reintroduces the Master's text. Added regression
tests for both the empty-and-present and absent cases.
3. (Medium) VsdxDocument.Pages.cs: ParseSizeCellEmu now catches the EMU
conversion's OverflowException for a pathologically large page
dimension and re-throws the documented InvalidDataException, preserving
the public error contract. Added a regression test with a 1e300-inch
PageWidth asserting InvalidDataException (not OverflowException).
4. (Low) NamespaceDoc.cs: replaced the stale "implementation is in
progress" remarks with an accurate description of the shipped
VsdxDocument/Render functionality and its known limitations (FillPattern
edge cases, one unsupported gradient pattern, minor UML text padding).
5. (Low) VsdxDocument.TextRender.cs: corrected the class summary - the text
painter is wired into RenderShapeRecursive via PaintTextLayout, not
"not yet wired into any public API".
6. (Low) VsdxShapeNode.cs: removed the incorrect "only for page-level
shapes" qualifier from the EffectiveCells doc - ResolveShapeRecursive
assigns it for every descendant shape too.
7. (Low) VsdxFixtures/README.md: confirmed the existing 14-file
davehoward-*/jgreywolfvsdxjs-* provenance list/count is accurate, and
added a clarifying note that the separate Apache-POI-derived
12-file/16-page corpus and smoke-test scratch tooling mentioned in the
PR description were never checked into this repository.
8. Removed the stale "VsdxUnsupportedFeatureException is thrown for
Foreign shapes / non-solid FillPattern" claim from VsdxDocument.cs's own
class remarks, docs/design/canvas-net-vsdx.md, and
docs/design/introduction.md, matching the wording already corrected in
docs/sysml2/model/canvas-net-vsdx/vsdx-document.sysml by commit f6e3cf0:
neither case is distinctly branched on or throws today.
9. Documented the TxtAngle/text-box-rotation fix
(ResolveTextToPixelTransform) from f6e3cf0: added a Key Methods entry in
docs/design/canvas-net-vsdx/vsdx-document.md, a new requirement
(CanvasNetVsdx-VsdxDocument-TextBoxRotationRendering) in
docs/reqstream/canvas-net-vsdx/vsdx-document.yaml, and a matching
verification section in docs/verification/canvas-net-vsdx/vsdx-document.md.
pwsh ./build.ps1: Build succeeded, 0 warnings, 0 errors; 11229/11229 tests
passed across all target frameworks.
pwsh ./lint.ps1: exit code 0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Link orphaned TextBoxRotationRendering requirement under CanvasNetVsdx-Render
The CanvasNetVsdx-VsdxDocument-TextBoxRotationRendering unit requirement
added for the TxtAngle text-box rotation fix (PR #42 round 1) was never
added as a child of its system-level parent, causing reqstream --enforce
to report it as orphaned (unreachable from any system/quality-tagged
requirement).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Malcolm Nixon <Malcolm.Nixon@hiarc.inc>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a header-only
GetInfoAPI toBmpCodec,PngCodec,TiffCodec, andJpegCodecthatparses only the file/stream header to report claimed image dimensions/format info, without
performing the expensive full pixel decode. This lets callers inspect a file's declared size
(
ImageInfo.Width/Height) and reject a suspected decompression-bomb / image-bomb filebefore calling
Load, which allocates a full RGBA32Surfacebuffer.Changes
CanvasNet.Codecs.ImageInforecord struct (Width,Height,Channels,HasAlpha).GetInfo(Stream)/GetInfo(string path)added to all four codecs, mirroring the existingLoadoverload-pairing convention and exception contract exactly (ArgumentNullException,ArgumentException,InvalidDataException).GetInforeports raw header dimensions and does not enforceSurface.MaxDimension-by design, so a caller can detect and reject oversized files that would otherwise fail inside
Load.enforceMaxDimensionflag soLoad(true, unchanged behavior) andGetInfo(false) share one parsing code path -no duplicated/divergent parsers.
TiffCodec.GetInfouses a genuinely lightweight, seek-based IFD tag probe (reads only theheader + the needed inline/out-of-line tags, never buffers the whole file or reads strip
data). It requires a seekable stream: since a TIFF's IFD can legitimately be located anywhere
in the file, a non-seekable stream is rejected immediately with
NotSupportedException,before any bytes are read, rather than falling back to buffering.
JpegCodec.GetInfoscans marker segments to find SOF0/SOF2 (skipping segment data, neverentropy-decoding), bounded by a new
MaxProbeHeaderBytes(1 MiB) limit.Surface.MaxDimensionwidened frominternaltopublic const intso external callers cancompare
GetInfo's reported dimensions against the same boundLoadenforces.malformed headers, oversized-dimensions-not-rejected, proof that
GetInfonever reads past theheader, TIFF non-seekable stream rejection, JPEG probe-limit-exceeded).
(
docs/reqstream/**), design docs (docs/design/**), verification docs (docs/verification/**),SysML2 model
sourceRefupdates,.reviewmark.yamlreview-set coverage, README and user guide.Validation
dotnet build: 0 warnings, 0 errors.pwsh ./build.ps1: 1497/1497 tests passed (499 distinct test methods x 3 TFMs: net8.0/net9.0/net10.0).dotnet reqstream --requirements requirements.yaml --enforce: exit 0, 0 orphans (unchangedfrom the pre-existing baseline on
main, which was also 0 orphans).dotnet reviewmark --plan <tempfile> --enforce: exit 0.pwsh ./fix.ps1thenpwsh ./lint.ps1: clean.This is new user-visible public API (
ImageInfo, fourGetInfooverload pairs, andSurface.MaxDimensionvisibility widening), so it is delivered as its own feature branch/PRrather than folded into #3.