fix(render): filter bundled engines in installed Quarto (#14529)#14531
Open
cderv wants to merge 3 commits into
Open
fix(render): filter bundled engines in installed Quarto (#14529)#14531cderv wants to merge 3 commits into
cderv wants to merge 3 commits into
Conversation
The metadata `engines` filter in pandoc.ts compared engine paths against the hardcoded substring `resources/extension-subtrees/`. That substring only appears when `QUARTO_SHARE_PATH` resolves to the source-tree `src/resources` layout used in dev mode. In installed Quarto the path is `<share>/extension-subtrees/` and the filter silently became a no-op — the absolute path to the bundled `julia-engine.js` leaked into both the pandoc log printout and the YAML metadata block of rendered output. Extract the predicate to `isBundledSubtreeEnginePath()` and the filter to `filterBundledSubtreeEngines()` in `src/extension/extension.ts`. Both compare against the resolved path returned by `builtinSubtreeExtensions()`, which matches in dev and installed layouts. Both filter call sites in `pandoc.ts` (`cleanMetadataForPrinting` and `pandocPassedMetadata`) now go through the helper.
Collaborator
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
The previous startsWith() check would also have matched sibling directories whose names share the `extension-subtrees` prefix (e.g. `extension-subtrees-custom/`), silently dropping user-supplied engines from Pandoc metadata. Require exact match or a path-separator boundary so only entries actually under `extension-subtrees/` are filtered.
The previous regex `resources[/\]extension-subtrees[/\]` only matched the dev-tree share path. The unique marker of a bundled-extension leak is the `extension-subtrees/` directory itself, regardless of whether the share root resolves to `src/resources/` (dev) or `<install>/share/` (installed). Drop the `resources` prefix so the assertion survives any future relayout of the dev-tree share path. Does not catch the installed-mode regression #14529 directly — that requires the unit test added in d591c77, since smoke-all in CI runs from the source tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When rendering a document with an installed Quarto (e.g. scoop, package managers), the absolute path of the bundled
julia-engineleaks into the rendered output's YAML metadata and into the pandoc log printout, instead of being stripped like in dev builds.Root Cause
The bundled-engine filter in
src/command/render/pandoc.tscompared engine paths against the hardcoded substringresources/extension-subtrees/. That substring only appears whenQUARTO_SHARE_PATHresolves to the source-tree layout (src/resources/). Installed Quarto usesshare/extension-subtrees/, so the filter silently became a no-op and the bundled engine's absolute path went through to both the printed metadata block and the YAML metadata file handed to Pandoc.The feature (bundled subtree extensions + filter) was introduced in v1.9.13; the bug has been present in installed Quarto since.
Fix
Extract the predicate to
isBundledSubtreeEnginePath()and the filter tofilterBundledSubtreeEngines()insrc/extension/extension.ts. Both compare engine paths against the resolved path returned bybuiltinSubtreeExtensions(), which matches dev and installed layouts. Both filter call sites inpandoc.ts(cleanMetadataForPrintingandpandocPassedMetadata) now go through the helper.Test Plan
tests/unit/extension/filter-bundled-engines.test.tscovers source-tree, POSIX-installed, Windows-installed, and user-supplied paths via the predicate, plus the no-arg filter under the current env.tests/docs/smoke-all/2025/12/22/markdown-engine-no-extension-subtrees.qmdstill passes..qmd—engines:block must be absent from both pandoc log and rendered markdown.Fixes #14529