Merge pull request #9428 from quarto-dev/bugfix/9426

update crossref.lua to use quarto_ast_pipeline

Author: cscheid

news/changelog-1.5.md

@@ -155,6 +155,7 @@ All changes included in 1.5:
 - ([#9059](https://github.com/quarto-dev/quarto-cli/issues/9059)): `quarto run` now properly works on Windows with Lua scripts.
 - ([#9282](https://github.com/quarto-dev/quarto-cli/issues/9282)): Fix name clash in Lua local declarations for `mediabag` in bundled releases.
 - ([#9394](https://github.com/quarto-dev/quarto-cli/issues/9394)): Make `template` a required field in the `about` schema.
+- ([#9426](https://github.com/quarto-dev/quarto-cli/issues/9426)): Update `crossref.lua` filter to avoid crashes and hangs in documents with custom AST nodes.
 - Add support for `{{< lipsum >}}` shortcode, which is useful for emitting placeholder text. Provide a specific number of paragraphs (`{{< lipsum 3 >}}`).
 - Resolve data URIs in Pandoc's mediabag when rendering documents.
 - Increase v8's max heap size by default, to avoid out-of-memory errors when rendering large documents (also cf. https://github.com/denoland/deno/issues/18935).

src/command/editor-support/crossref.ts

@@ -126,6 +126,10 @@ const makeCrossrefCommand = () => {
           stdout: "piped",
         },
         input,
+        undefined, // mergeOutput?: "stderr>stdout" | "stdout>stderr",
+        undefined, // stderrFilter?: (output: string) => string,
+        undefined, // respectStreams?: boolean,
+        5000,
       );
 
       // check for error

src/core/process.ts

@@ -36,7 +36,18 @@ export async function execProcess(
   mergeOutput?: "stderr>stdout" | "stdout>stderr",
   stderrFilter?: (output: string) => string,
   respectStreams?: boolean,
+  timeout?: number,
 ): Promise<ProcessResult> {
+  const withTimeout = <T>(promise: Promise<T>): Promise<T> => {
+    return timeout
+      ? Promise.race([
+        promise,
+        new Promise((_, reject) =>
+          setTimeout(() => reject(new Error("Process timed out")), timeout)
+        ),
+      ]) as Promise<T>
+      : promise;
+  };
   ensureCleanup();
   // define process
   try {
@@ -150,11 +161,11 @@ export async function execProcess(
           }),
         );
       }
-      await Promise.all(promises);
+      await withTimeout(Promise.all(promises));
     }
 
     // await result
-    const status = await process.status();
+    const status = await withTimeout(process.status());
 
     // close the process
     process.close();

src/resources/filters/crossref/crossref.lua

@@ -156,34 +156,8 @@ local quarto_normalize_filters = {
   end, normalize_filter()) },
 
   { name = "normalize-capture-reader-state", filter = normalize_capture_reader_state() },
-
-  { name = "pre-table-merge-raw-html", 
-    filter = table_merge_raw_html()
-  },
-
-  -- { name = "pre-content-hidden-meta",
-  --   filter = content_hidden_meta() },
-
-  -- 2023-04-11: We want to combine combine-1 and combine-2, but parse_md_in_html_rawblocks
-  -- can't be combined with parse_html_tables. combineFilters
-  -- doesn't inspect the contents of the results in the inner loop in case
-  -- the result is "spread" into a Blocks or Inlines.
-  
-  { name = "normalize-combined-1", filter = combineFilters({
-      parse_html_tables(),
-      parse_extended_nodes(),
-      code_filename(),
-    })
-  },
-  { 
-    name = "normalize-combine-2", 
-    filter = combineFilters({
-      parse_md_in_html_rawblocks(),
-      parse_floatreftargets(),
-      parse_blockreftargets(),
-    }),
-  },
 }
+tappend(quarto_normalize_filters, quarto_ast_pipeline())
 
 local quarto_pre_filters = {
   -- quarto-pre