[benkeks]

The contents shortcode filter produces unexpected character '<' errors and malformed-document warnings on ordinary input, and might remove it from the output. This is because it attempts to JSON-decode any paragraph or plain block containing a single raw inline, without checking its format.

For instance, in the smoke-test example the filter spams console output with the following ERROR/WARNING messages:

ERROR (/opt/quarto/share/pandoc/datadir/_json.lua:212) unexpected character '<' at line 1 col 1
WARNING (/opt/quarto/share/filters/main.lua:16354) [Malformed document] Failed to decode quarto-internal JSON: 
/opt/quarto/share/pandoc/datadir/_json.lua:193: bad 'for' initial value (number expected, got nil)
. Removing from document.
ERROR (/opt/quarto/share/pandoc/datadir/_json.lua:212) unexpected character '<' at line 1 col 1
WARNING (/opt/quarto/share/filters/main.lua:16354) [Malformed document] Failed to decode quarto-internal JSON: 
/opt/quarto/share/pandoc/datadir/_json.lua:193: bad 'for' initial value (number expected, got nil)
. Removing from document.

The proposed fix is to only decode raw inlines with format quarto-internal, matching the checks elsewhere in the filter.

Also, a small smoke test is added, which verifies that raw HTML survives in paragraphs and list items, that content reuse still works, and that rendering emits no errors or warnings.

Checklist

I have (if applicable):

• [ ] referenced the GitHub issue this PR closes
• updated the appropriate changelog in the PR
• ensured the present test suite passes
• added new tests
• [ ] created a separate documentation PR in Quarto's website repo and linked it to this PR (does not apply)

AI-assisted PR

• AI tool used: e.g., GitHub Copilot on GPT-6.1
• Codebase grounding: local clone
• Human review: I have reviewed, tested, and verified the AI-generated content before submitting.

Note: autonomous AI agents submitting PRs without human oversight are not permitted — see the Code of Conduct.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[mcanouil]

@benkeks Thanks for the PR, please be sure to read the contributing guidelines (especially "AI-assisted contributions" section), and to use and follow the Pull Request template.

[cscheid]

That looks like a great catch, thanks!