a53b9958fa734f73aeffb9ddfe2fbad1ca65f90c
galt
  Mon Jan 30 16:18:41 2017 -0800
Check-in of CSP2 Content-Security-Policy work. All C-language CGIs should now support CSP2 in browser to stop major forms of XSS javascript injection. Javascript on pages is gathered together, and then emitted in a single script block at the end with a nonce that tells the browser, this is js that we generated instead of being injected by a hacker. Both inline script from script blocks and inline js event handlers had to be pulled out and separated. You will not see js sprinkled through-out the page now. Older browsers that support CSP1 or that do not understand CSP at all will still work, just without protection. External js libraries loaded at runtime need to be added to the CSP policy header in src/lib/htmshell.c.

diff --git src/hg/hgTrackUi/hgTrackUi.c src/hg/hgTrackUi/hgTrackUi.c
index 5651716..0929350 100644
--- src/hg/hgTrackUi/hgTrackUi.c
+++ src/hg/hgTrackUi/hgTrackUi.c
@@ -600,42 +600,42 @@
 if (version <= 127)
     {
     labels = snp125ColorSourceLabels;
     arraySize = snp125ColorSourceArraySize;
     }
 else if (version <= 131)
     {
     labels = snp128ColorSourceLabels;
     arraySize = snp128ColorSourceArraySize;
     }
 
 // It would be preferable for Javascript to handle changing the color selection
 // menus when the color source selection changes, but for now we do a submit that
 // returns to the current vertical position:
 char autoSubmit[2048];
-safef(autoSubmit, sizeof(autoSubmit), "onchange=\""
+safef(autoSubmit, sizeof(autoSubmit), ""
       "document."MAIN_FORM".action = '%s'; %s"
-      "document."MAIN_FORM".submit();\"",
+      "document."MAIN_FORM".submit();",
       cgiScriptName(), jsSetVerticalPosition(MAIN_FORM));
 cgiContinueHiddenVar("g");
 cgiContinueHiddenVar("c");
 
 char cartVar[512];
 safef(cartVar, sizeof(cartVar), "%s.colorSource", tdb->track);
 enum snp125ColorSource colorSourceCart = snp125ColorSourceFromCart(cart, tdb);
 char *colorSourceSelected = snp125ColorSourceToLabel(tdb, colorSourceCart);
-cgiMakeDropListFull(cartVar, labels, labels, arraySize, colorSourceSelected, autoSubmit);
+cgiMakeDropListFull(cartVar, labels, labels, arraySize, colorSourceSelected, "change", autoSubmit);
 printf("&nbsp;\n");
 char javascript[2048];
 safef(javascript, sizeof(javascript),
       "document."MAIN_FORM".action='%s'; %s document."MAIN_FORM".submit();",
       cgiScriptName(), jsSetVerticalPosition(MAIN_FORM));
 cgiMakeOnClickSubmitButton(javascript, defaultButtonVar, JS_DEFAULTS_BUTTON_LABEL);
 printf("<BR><BR>\n"
        "The selected &quot;Feature for Color Specification&quot; above has the\n"
        "selection of colors below for each attribute. Only the color\n"
        "options for the feature selected above will be used to color items;\n"
        "color options for other features will not be shown.\n");
 
 if (version > 127 && colorSourceCart == snp125ColorSourceLocType)
     colorSourceCart = SNP125_DEFAULT_COLOR_SOURCE;
 switch (colorSourceCart)
@@ -2247,40 +2247,41 @@
 printf("<B>Color sequence matches by </B>");
 char *colorText[3] = {"topic", "impact of journal", "year"};
 char *colorVals[3] = {"topic", "impact", "year"};
 safef(cgiVar,sizeof(cgiVar),"%s.%s",tdb->track,PUBS_COLORBY_TAG);
 cgiDropDownWithTextValsAndExtra(cgiVar, colorText, colorVals, 3, colorBy, NULL);
 puts("</P>\n");
 
 wigOption(cart, tdb->track, tdb->shortLabel, tdb);
 }
 
 void oligoMatchUi(struct trackDb *tdb)
 /* UI for oligo match track */
 {
 char *oligo = cartUsualString(cart, oligoMatchVar, oligoMatchDefault);
 puts("<P><B>Short (2-30 base) sequence:</B>");
-puts("<script>\
-    function packTrack () \
-    { \
-    var box = jQuery('select[name$=oligoMatch]'); \
-    if (box.val()=='hide') \
-        box.val('pack'); \
-    } \
-    </script>");
-printf("<input name=\"%s\" size=\"%d\" value=\"%s\" oninput=\"packTrack();\" type=\"TEXT\">", \
-    oligoMatchVar, 45, oligo);
+char *javascript = 
+"function packTrack()\n"
+"{\n"
+"var box = jQuery('select[name$=oligoMatch]');\n"
+"if (box.val()=='hide')\n"
+"    box.val('pack');\n"
+"}\n";
+jsInline(javascript);
+printf("<input name='%s' id='%s' size=\"%d\" value=\"%s\" type=\"TEXT\">", 
+    oligoMatchVar, oligoMatchVar, 45, oligo);
+jsOnEventById("input", oligoMatchVar, "packTrack();");
 }
 
 void cutterUi(struct trackDb *tdb)
 /* UI for restriction enzyme track */
 {
 char *enz = cartUsualString(cart, cutterVar, cutterDefault);
 puts("<P><B>Filter display by enzymes (separate with commas):</B><BR>");
 cgiMakeTextVar(cutterVar, enz, 100);
 }
 
 void genericWiggleUi(struct trackDb *tdb, int optionNum )
 /* put up UI for any standard wiggle track (a.k.a. sample track)*/
 {
 
 char options[7][256];
@@ -2723,103 +2724,88 @@
 #ifdef UNUSED
 static boolean isInTrackList(struct trackDb *tdbList, struct trackDb *target)
 /* Return TRUE if target is in tdbList. */
 {
 struct trackDb *tdb;
 for (tdb = tdbList; tdb != NULL; tdb = tdb->next)
     if (tdb == target)
         return TRUE;
 return FALSE;
 }
 #endif /* UNUSED */
 
 void superTrackUi(struct trackDb *superTdb, struct trackDb *tdbList)
 /* List tracks in this collection, with visibility controls and UI links */
 {
-#define SUPERS_WITH_CHECKBOXES
-#ifdef SUPERS_WITH_CHECKBOXES
-#define PM_BUTTON_GLOBAL "<IMG height=18 width=18 onclick=\"superT.plusMinus(%s);\" " \
-                         "id='btn_%s' src='../images/%s'>"
-#define    BUTTON_PLUS_SUPER()  printf(PM_BUTTON_GLOBAL,"true",  "plus_all",   "add_sm.gif")
-#define    BUTTON_MINUS_SUPER() printf(PM_BUTTON_GLOBAL,"false","minus_all","remove_sm.gif")
 jsIncludeFile("hui.js",NULL);
-#endif///def SUPERS_WITH_CHECKBOXES
 printf("\n<P><TABLE CELLPADDING=2>");
 tdbRefSortPrioritiesFromCart(cart, &superTdb->children);
 struct slRef *childRef;
+char javascript[1024];
 for (childRef = superTdb->children; childRef != NULL; childRef = childRef->next)
     {
     struct trackDb *tdb = childRef->val;
-    #ifdef SUPERS_WITH_CHECKBOXES
     if (childRef == superTdb->children) // first time through
         {
         printf("\n<TR><TD NOWRAP colspan=2>");
-        BUTTON_PLUS_SUPER();
-        BUTTON_MINUS_SUPER();
+	printf("<IMG height=18 width=18 id='btn_plus_all' src='../images/add_sm.gif'>");
+	safef(javascript, sizeof javascript, "superT.plusMinus(true);");
+	jsOnEventById("click", "btn_plus_all", javascript);
+	printf("<IMG height=18 width=18 id='btn_minus_all' src='../images/remove_sm.gif'>");
+	safef(javascript, sizeof javascript, "superT.plusMinus(false);");
+	jsOnEventById("click", "btn_minus_all", javascript);
         printf("&nbsp;<B>All</B><BR>");
         printf("</TD></TR>\n");
         }
     printf("<TR><TD NOWRAP>");
     if (!tdbIsDownloadsOnly(tdb))
         {
+	char id[256];
         enum trackVisibility tv =
                 hTvFromString(cartUsualString(cart, tdb->track,hStringFromTv(tdb->visibility)));
         // Don't use cheapCgi code... no name and no boolshad... just js
-        printf("<INPUT TYPE=CHECKBOX id='%s' onchange='superT.childChecked(this);'%s>",
+        printf("<INPUT TYPE=CHECKBOX id='%s'%s>",
                tdb->track, (tv != tvHide?" CHECKED":""));
+	safef(id, sizeof id, "%s", tdb->track);
+	safef(javascript, sizeof javascript, "superT.childChecked(this);");
+	jsOnEventById("change", id, javascript);    // TODO XSS Filter track as id?
+
+
+        safef(javascript, sizeof(javascript), "superT.selChanged(this)");
+        struct slPair *event = slPairNew("change", cloneString(javascript));
         hTvDropDownClassVisOnlyAndExtra(tdb->track, tv, tdb->canPack,
                                         (tv == tvHide ? "hiddenText":"normalText"),
                                         trackDbSetting(tdb, "onlyVisibility"),
-                                        "onchange='superT.selChanged(this);'");
+                                        event);
+
         printf("</TD>\n<TD>");
-        printf("<A HREF='%s?%s=%s&c=%s&g=%s' onclick='return superT.submitAndLink(this);'>"
+	safef(id, sizeof id, "%s_link", tdb->track);
+        printf("<A HREF='%s?%s=%s&c=%s&g=%s' id='%s'>"
                "%s</A>&nbsp;", (tdbIsDownloadsOnly(tdb)? hgFileUiName(): hgTrackUiName()),
                cartSessionVarName(), cartSessionId(cart),
-               chromosome, cgiEncode(tdb->track), tdb->shortLabel);
+               chromosome, cgiEncode(tdb->track), id, tdb->shortLabel);
+        safef(javascript, sizeof(javascript), "superT.submitAndLink(this);");
+	jsOnEventById("click", id, javascript);    // TODO XSS Filter track as id?
         }
     else
         {
         printf("<A HREF='%s?%s=%s&g=%s'>Downloads</A>",
                hgFileUiName(),cartSessionVarName(), cartSessionId(cart), cgiEncode(tdb->track));
         printf("</TD>\n<TD>");
         printf("%s&nbsp;",tdb->shortLabel);
         }
     printf("</TD>\n");
-    #else///ifndef SUPERS_WITH_CHECKBOXES
-    printf("<TR><TD NOWRAP>");
-    if (tdbIsDownloadsOnly(tdb))
-        printf("%s&nbsp;",tdb->shortLabel);
-    else
-        printf("<A HREF='%s?%s=%s&c=%s&g=%s'>%s</A>&nbsp;",
-               (tdbIsDownloadsOnly(tdb)? hgFileUiName(): hgTrackUiName()),
-               cartSessionVarName(), cartSessionId(cart),
-               chromosome, cgiEncode(tdb->track), tdb->shortLabel);
-    printf("</TD><TD>");
-    if (tdbIsDownloadsOnly(tdb))
-        {
-        printf("<A HREF='%s?%s=%s&g=%s'>Downloads</A>",
-               hgFileUiName(),cartSessionVarName(), cartSessionId(cart), cgiEncode(tdb->track));
-        }
-    else
-        {
-        enum trackVisibility tv =
-                hTvFromString(cartUsualString(cart, tdb->track, hStringFromTv(tdb->visibility)));
-        hTvDropDownClassVisOnly(tdb->track, tv, tdb->canPack,
-                                tv == tvHide ?  "hiddenText" : "normalText",
-                                trackDbSetting(tdb, "onlyVisibility"));
-        }
-    #endif///ndef SUPERS_WITH_CHECKBOXES
     printf("<TD>%s", tdb->longLabel);
     char *dataVersion = trackDbSetting(tdb, "dataVersion");
     if (dataVersion)
         printf("&nbsp&nbsp;<EM style='color:#666666; font-size:smaller;'>%s</EM>", dataVersion);
     printf("</TD></TR>");
     }
 printf("</TABLE>");
 }
 
 #ifdef USE_HAL
 static void cfgHalSnake(struct trackDb *tdb, char *name)
 {
 boolean parentLevel = isNameAtParentLevel(tdb, name);
 if (parentLevel)
     return;
@@ -2840,31 +2826,31 @@
 if (count == 0)
     return;
 char codeVarName[1024];
 safef(codeVarName, sizeof codeVarName, "%s.coalescent", tdb->track);
 char **ancestors;
 AllocArray(ancestors, count);
 count = 0;
 for(sp=speciesList; sp; sp = sp->next)
     {
     ancestors[count] = sp->name;
     count++;
     }
 char *coalescent = cartOptionalString(cart, codeVarName);
 printf("<B>Set Coalescent Ancestor to:</B>");
 cgiMakeDropListFull(codeVarName, ancestors, ancestors,
-    count, coalescent, NULL);
+    count, coalescent, NULL, NULL);
 }
 #endif
 
 void specificUi(struct trackDb *tdb, struct trackDb *tdbList, struct customTrack *ct, boolean ajax)
 /* Draw track specific parts of UI. */
 {
 char *track = tdb->track;
 // Ideally check cfgTypeFromTdb()/cfgByCfgType() first, but with all these special cases already in
 //    place, lets be cautious at this time.
 // NOTE: Developer, please try to use cfgTypeFromTdb()/cfgByCfgType().
 
 boolean boxed = trackDbSettingClosestToHomeOn(tdb, "boxedCfg");
 // UI precedence:
 // 1) supers to get them out of the way: they have no controls
 // 2) special cases based upon track name (developer please avoid)
@@ -3063,41 +3049,40 @@
  * super's children list. Also do some visibility and parentName futzing. */
 {
 struct trackDb *tdb;
 for (tdb = tdbList; tdb != NULL; tdb = tdb->next)
     {
     if (tdb->parent == super)
         {
 	trackDbSuperMemberSettings(tdb);  /* This adds tdb to tdb->parent->children. */
 	}
     }
 }
 #endif /* UNUSED */
 
 struct jsonElement *jsonGlobalsHash = NULL; 
 
-void jsonPrintGlobals(boolean wrapWithScriptTags)
+void jsonPrintGlobals()
 // prints out the "common" globals json hash
 // This hash is the one utils.js and therefore all CGIs know about
 {
 if (jsonGlobalsHash != NULL)
     {
-    if (wrapWithScriptTags)
-        printf("<script type='text/javascript'>\n");
-    jsonPrint(jsonGlobalsHash, "common", 0);
-    if (wrapWithScriptTags)
-        printf("</script>\n");
+    struct dyString *dy = dyStringNew(1024);
+    jsonDyStringPrint(dy, jsonGlobalsHash, "common", 0);
+    jsInline(dy->string);
+    dyStringFree(&dy);
     }
 }
 
 void jsonObjectAddGlobal(char *name, struct jsonElement *ele)
 /* Add json object to global hash */
 {
 if (jsonGlobalsHash == NULL)
     jsonGlobalsHash = newJsonObject(newHash(5));
 jsonObjectAdd(jsonGlobalsHash, name, ele);
 }
 
 void trackUi(struct trackDb *tdb, struct trackDb *tdbList, struct customTrack *ct, boolean ajax)
 /* Put up track-specific user interface. */
 {
 if (!ajax)
@@ -3260,73 +3245,80 @@
         enum trackVisibility vis = tdb->visibility;
         boolean canPack = rTdbTreeCanPack(tdb);
         if (ajax)
             {
             // ajax popups should show currently inherited visability
             vis = tdbVisLimitedByAncestry(cart, tdb, TRUE);
             // composite children may inherit squish/pack vis so allow it.
             if (canPack == FALSE && tdbIsCompositeChild(tdb))
                 canPack = rTdbTreeCanPack(tdbGetComposite(tdb));
             }
         else                               // But hgTrackUi page should show local vis
             vis = hTvFromString(cartUsualString(cart,tdb->track, hStringFromTv(vis)));
 
         if (tdbIsSuperTrackChild(tdb))
             {
+	    char javascript[1024];
+	    safef(javascript, sizeof(javascript), "visTriggersHiddenSelect(this);");
+	    struct slPair *event = slPairNew("change", cloneString(javascript));
+
             hTvDropDownClassVisOnlyAndExtra(tdb->track,vis,canPack,"normalText superChild visDD",
-                                            trackDbSetting(tdb, "onlyVisibility"),
-                                            "onchange='visTriggersHiddenSelect(this);'");
+                                            trackDbSetting(tdb, "onlyVisibility"), event);
             }
         else
             hTvDropDownClassVisOnlyAndExtra(tdb->track,vis,canPack,"normalText visDD",
                                             trackDbSetting(tdb, "onlyVisibility"),NULL);
         }
 
     if (!ajax)
         {
         printf("&nbsp;");
         cgiMakeButton("Submit", "Submit");
         // Offer cancel button always?    // composites and multiTracks (not standAlones or supers)
         if (tdbIsContainer(tdb))
             {
             printf("&nbsp;");
-            cgiMakeOnClickButton("window.history.back();","Cancel");
+            cgiMakeOnClickButton("htui_cancel", "window.history.back();","Cancel");
             }
 
         if (tdbIsComposite(tdb))
-            printf("\n&nbsp;&nbsp;<a href='#' "
-                   "onclick='setVarAndPostForm(\"%s\",\"1\",\"mainForm\"); "
-                   "return false;'>Reset to defaults</a>\n",setting);
+	    {
+            printf("\n&nbsp;&nbsp;<a href='#' id='htui_reset'>Reset to defaults</a>\n");
+	    char javascript[1024];
+	    safef(javascript, sizeof javascript, 
+                   "setVarAndPostForm('%s','1','mainForm'); return false;", setting);
+	    jsOnEventById("click", "htui_reset", javascript);
+	    }
         }
 
     if (ct)
         {
         puts("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
         cgiMakeButton(CT_DO_REMOVE_VAR, "Remove custom track");
         cgiMakeHiddenVar(CT_SELECTED_TABLE_VAR, tdb->track);
         puts("&nbsp;");
         if (differentString(tdb->type, "chromGraph"))
             {
             char buf[256];
             if (ajax)
                 // reference to a separate form doesn't work in modal dialog,
                 // so change window.location directly.
                 safef(buf, sizeof(buf), "window.location='%s?hgsid=%s&%s=%s';return false;",
                       hgCustomName(), cartSessionId(cart), CT_SELECTED_TABLE_VAR, tdb->track);
             else
                 safef(buf, sizeof(buf), "document.customTrackForm.submit();return false;");
-            cgiMakeOnClickButton(buf, "Update custom track");
+            cgiMakeOnClickButton("htui_updtCustTrk", buf, "Update custom track");
             }
         }
     }
 
 if (!tdbIsSuper(tdb) && !tdbIsDownloadsOnly(tdb) && !ajax)
     {
     // NAVLINKS - For pages w/ matrix, add Description, Subtracks and Downloads links
     if (trackDbSetting(tdb, "dimensions")
     ||  (trackDbSetting(tdb, "wgEncode") && tdbIsComposite(tdb)))
         {
         printf("\n&nbsp;&nbsp;<span id='navDown' style='float:right; display:none;'>");
         if (trackDbSetting(tdb, "wgEncode"))
             {
             printf("<A TARGET=_BLANK HREF='../ENCODE/index.html' TITLE='ENCODE Portal'>ENCODE at UCSC</A>");
             printf("&nbsp;&nbsp;");
@@ -3521,31 +3513,31 @@
 	    track, database, chromosome);
    }
 char *title = (tdbIsSuper(tdb) ? "Super-track Settings" :
                tdbIsDownloadsOnly(tdb) ? DOWNLOADS_ONLY_TITLE : "Track Settings");
 if(cartOptionalString(cart, "ajax"))
     {
     // html is going to be used w/n a dialog in hgTracks.js so serve up stripped down html
     trackUi(tdb, tdbList, ct, TRUE);
     cartRemove(cart,"ajax");
     }
 else
     {
     cartWebStart(cart, database, "%s %s", tdb->shortLabel, title);
     trackUi(tdb, tdbList, ct, FALSE);
     printf("<BR>\n");
-    jsonPrintGlobals(TRUE);
+    jsonPrintGlobals();
     webEnd();
     }
 }
 
 char *excludeVars[] = { "submit", "Submit", "g", NULL, "ajax", NULL,};
 
 int main(int argc, char *argv[])
 /* Process command line. */
 {
 long enteredMainTime = clock1000();
 cgiSpoof(&argc, argv);
 cartEmptyShell(doMiddle, hUserCookie(), excludeVars, NULL);
 cgiExitTime("hgTrackUi", enteredMainTime);
 return 0;
 }