From 2979309e7db632d3c3c21cfc438f082c80f5a699 Mon Sep 17 00:00:00 2001
From: Carlos Scheidegger <carlos.scheidegger@rstudio.com>
Date: Fri, 19 Apr 2024 15:08:54 -0700
Subject: [PATCH 1/3] lua,crossref filter - use quarto_ast_pipeline

---
 src/resources/filters/crossref/crossref.lua | 28 +--------------------
 1 file changed, 1 insertion(+), 27 deletions(-)

diff --git a/src/resources/filters/crossref/crossref.lua b/src/resources/filters/crossref/crossref.lua
index 08d032c204..bcaac992c9 100644
--- a/src/resources/filters/crossref/crossref.lua
+++ b/src/resources/filters/crossref/crossref.lua
@@ -156,34 +156,8 @@ local quarto_normalize_filters = {
   end, normalize_filter()) },
 
   { name = "normalize-capture-reader-state", filter = normalize_capture_reader_state() },
-
-  { name = "pre-table-merge-raw-html", 
-    filter = table_merge_raw_html()
-  },
-
-  -- { name = "pre-content-hidden-meta",
-  --   filter = content_hidden_meta() },
-
-  -- 2023-04-11: We want to combine combine-1 and combine-2, but parse_md_in_html_rawblocks
-  -- can't be combined with parse_html_tables. combineFilters
-  -- doesn't inspect the contents of the results in the inner loop in case
-  -- the result is "spread" into a Blocks or Inlines.
-  
-  { name = "normalize-combined-1", filter = combineFilters({
-      parse_html_tables(),
-      parse_extended_nodes(),
-      code_filename(),
-    })
-  },
-  { 
-    name = "normalize-combine-2", 
-    filter = combineFilters({
-      parse_md_in_html_rawblocks(),
-      parse_floatreftargets(),
-      parse_blockreftargets(),
-    }),
-  },
 }
+tappend(quarto_normalize_filters, quarto_ast_pipeline())
 
 local quarto_pre_filters = {
   -- quarto-pre

From 2e28ad7292209e47b4d4fdba037421867011d0ab Mon Sep 17 00:00:00 2001
From: Carlos Scheidegger <carlos.scheidegger@rstudio.com>
Date: Fri, 19 Apr 2024 15:12:49 -0700
Subject: [PATCH 2/3] add 5s timeout to crossref command

---
 src/command/editor-support/crossref.ts |  4 ++++
 src/core/process.ts                    | 15 +++++++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/command/editor-support/crossref.ts b/src/command/editor-support/crossref.ts
index 125b73ea85..f028cd292f 100644
--- a/src/command/editor-support/crossref.ts
+++ b/src/command/editor-support/crossref.ts
@@ -126,6 +126,10 @@ const makeCrossrefCommand = () => {
           stdout: "piped",
         },
         input,
+        undefined, // mergeOutput?: "stderr>stdout" | "stdout>stderr",
+        undefined, // stderrFilter?: (output: string) => string,
+        undefined, // respectStreams?: boolean,
+        5000,
       );
 
       // check for error
diff --git a/src/core/process.ts b/src/core/process.ts
index 838a1164e5..c21c6ca672 100644
--- a/src/core/process.ts
+++ b/src/core/process.ts
@@ -36,7 +36,18 @@ export async function execProcess(
   mergeOutput?: "stderr>stdout" | "stdout>stderr",
   stderrFilter?: (output: string) => string,
   respectStreams?: boolean,
+  timeout?: number,
 ): Promise<ProcessResult> {
+  const withTimeout = <T>(promise: Promise<T>): Promise<T> => {
+    return timeout
+      ? Promise.race([
+        promise,
+        new Promise((_, reject) =>
+          setTimeout(() => reject(new Error("Process timed out")), timeout)
+        ),
+      ]) as Promise<T>
+      : promise;
+  };
   ensureCleanup();
   // define process
   try {
@@ -150,11 +161,11 @@ export async function execProcess(
           }),
         );
       }
-      await Promise.all(promises);
+      await withTimeout(Promise.all(promises));
     }
 
     // await result
-    const status = await process.status();
+    const status = await withTimeout(process.status());
 
     // close the process
     process.close();

From df9f510659cc2eab1f9be095f28b3e9403f4f629 Mon Sep 17 00:00:00 2001
From: Carlos Scheidegger <carlos.scheidegger@rstudio.com>
Date: Fri, 19 Apr 2024 15:43:20 -0700
Subject: [PATCH 3/3] changelog

---
 news/changelog-1.5.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/news/changelog-1.5.md b/news/changelog-1.5.md
index 136d1fa791..beca918e41 100644
--- a/news/changelog-1.5.md
+++ b/news/changelog-1.5.md
@@ -154,6 +154,7 @@ All changes included in 1.5:
 - ([#9059](https://github.com/quarto-dev/quarto-cli/issues/9059)): `quarto run` now properly works on Windows with Lua scripts.
 - ([#9282](https://github.com/quarto-dev/quarto-cli/issues/9282)): Fix name clash in Lua local declarations for `mediabag` in bundled releases.
 - ([#9394](https://github.com/quarto-dev/quarto-cli/issues/9394)): Make `template` a required field in the `about` schema.
+- ([#9426](https://github.com/quarto-dev/quarto-cli/issues/9426)): Update `crossref.lua` filter to avoid crashes and hangs in documents with custom AST nodes.
 - Add support for `{{< lipsum >}}` shortcode, which is useful for emitting placeholder text. Provide a specific number of paragraphs (`{{< lipsum 3 >}}`).
 - Resolve data URIs in Pandoc's mediabag when rendering documents.
 - Increase v8's max heap size by default, to avoid out-of-memory errors when rendering large documents (also cf. https://github.com/denoland/deno/issues/18935).