a53b9958fa734f73aeffb9ddfe2fbad1ca65f90c
galt
Mon Jan 30 16:18:41 2017 -0800
Check-in of CSP2 Content-Security-Policy work. All C-language CGIs should now support CSP2 in browser to stop major forms of XSS javascript injection. Javascript on pages is gathered together, and then emitted in a single script block at the end with a nonce that tells the browser, this is js that we generated instead of being injected by a hacker. Both inline script from script blocks and inline js event handlers had to be pulled out and separated. You will not see js sprinkled through-out the page now. Older browsers that support CSP1 or that do not understand CSP at all will still work, just without protection. External js libraries loaded at runtime need to be added to the CSP policy header in src/lib/htmshell.c.
diff --git src/hg/hgPcr/hgPcr.c src/hg/hgPcr/hgPcr.c
index 5562e9d..91c9bb6 100644
--- src/hg/hgPcr/hgPcr.c
+++ src/hg/hgPcr/hgPcr.c
@@ -1,646 +1,655 @@
/* hgPcr - In-silico PCR CGI for UCSC. */
/* Copyright (C) 2014 The Regents of the University of California
* See README in this or parent directory for licensing information. */
#include "common.h"
#include "hash.h"
#include "errAbort.h"
#include "errCatch.h"
#include "hCommon.h"
#include "dystring.h"
#include "jksql.h"
#include "linefile.h"
#include "dnautil.h"
#include "fa.h"
#include "psl.h"
#include "gfPcrLib.h"
#include "cheapcgi.h"
#include "htmshell.h"
#include "hdb.h"
#include "hui.h"
#include "cart.h"
#include "dbDb.h"
#include "blatServers.h"
#include "targetDb.h"
#include "pcrResult.h"
#include "trashDir.h"
#include "web.h"
#include "botDelay.h"
#include "oligoTm.h"
struct cart *cart; /* The user's ui state. */
struct hash *oldVars = NULL;
void usage()
/* Explain usage and exit. */
{
errAbort(
"hgPcr - In-silico PCR CGI for UCSC\n"
"usage:\n"
" hgPcr XXX\n"
"options:\n"
" -xxx=XXX\n"
);
}
struct pcrServer
/* Information on a server running on genomic assembly sequence. */
{
struct pcrServer *next; /* Next in list. */
char *db; /* Database name. */
char *genome; /* Genome name. */
char *description; /* Assembly description */
char *host; /* Name of machine hosting server. */
char *port; /* Port that hosts server. */
char *seqDir; /* Directory of sequence files. */
};
struct targetPcrServer
/* Information on a server running on non-genomic sequence, e.g. mRNA,
* that has been aligned to a particular genomic assembly. */
{
struct targetPcrServer *next; /* Next in list. */
char *host; /* Name of machine hosting server. */
char *port; /* Port that hosts server. */
struct targetDb *targetDb; /* All of the info about the target. */
};
struct pcrServer *getServerList()
/* Get list of available servers. */
{
struct pcrServer *serverList = NULL, *server;
struct sqlConnection *conn = hConnectCentral();
struct sqlResult *sr;
char **row;
/* Do a little join to get data to fit into the pcrServer. */
sr = sqlGetResult(conn,
NOSQLINJ "select dbDb.name,dbDb.genome,dbDb.description,blatServers.host,"
"blatServers.port,dbDb.nibPath "
"from dbDb,blatServers where "
"dbDb.name = blatServers.db "
"and blatServers.canPcr = 1 order by dbDb.orderKey" );
while ((row = sqlNextRow(sr)) != NULL)
{
AllocVar(server);
server->db = cloneString(row[0]);
server->genome = cloneString(row[1]);
server->description = cloneString(row[2]);
server->host = cloneString(row[3]);
server->port = cloneString(row[4]);
server->seqDir = hReplaceGbdbSeqDir(row[5], server->db);
slAddHead(&serverList, server);
}
sqlFreeResult(&sr);
hDisconnectCentral(&conn);
if (serverList == NULL)
errAbort("Sorry, no PCR servers are available");
slReverse(&serverList);
return serverList;
}
struct pcrServer *findServer(char *db, struct pcrServer *serverList)
/* Return server for given database. Db can either be
* database name or description. */
{
struct pcrServer *server;
for (server = serverList; server != NULL; server = server->next)
{
if (sameString(db, server->db))
return server;
}
errAbort("Can't find a server for PCR database %s\n", db);
return NULL;
}
struct targetPcrServer *getTargetServerList(char *db, char *name)
/* Get list of available non-genomic-assembly target pcr servers associated
* with db (and name, if not NULL). There may be none -- that's fine. */
{
struct targetPcrServer *serverList = NULL, *server;
struct sqlConnection *conn = hConnectCentral();
struct sqlConnection *conn2 = hAllocConn(db);
struct sqlResult *sr;
char **row;
struct dyString *dy = dyStringNew(0);
sqlDyStringPrintf(dy,
"select b.host, b.port, t.* from targetDb as t, blatServers as b "
"where b.db = t.name and t.db = '%s' and b.canPcr = 1 ",
db);
if (isNotEmpty(name))
sqlDyStringPrintf(dy, "and t.name = '%s' ", name);
dyStringAppend(dy, "order by t.priority");
sr = sqlGetResult(conn, dy->string);
while ((row = sqlNextRow(sr)) != NULL)
{
/* Keep this server only if its timestamp is newer than the tables
* and file on which it depends. */
struct targetDb *target = targetDbMaybeLoad(conn2, row+2);
if (target != NULL)
{
AllocVar(server);
server->host = cloneString(row[0]);
server->port = cloneString(row[1]);
server->targetDb = target;
slAddHead(&serverList, server);
}
}
dyStringFree(&dy);
sqlFreeResult(&sr);
hDisconnectCentral(&conn);
hFreeConn(&conn2);
slReverse(&serverList);
return serverList;
}
void doHelp()
/* Print up help page */
{
puts(
"In-Silico PCR searches a sequence database with a pair of\n"
"PCR primers, using an indexing strategy for fast performance.\n"
"\n"
"
Configuration Options
\n"
"Genome and Assembly - The sequence database to search. \n"
"Target - If available, choose to query transcribed sequences. \n"
"Forward Primer - Must be at least 15 bases in length. \n"
"Reverse Primer - On the opposite strand from the forward primer. Minimum length of 15 bases. \n"
"Max Product Size - Maximum size of amplified region. \n"
"Min Perfect Match - Number of bases that match exactly on 3' end of primers. Minimum match size is 15. \n"
"Min Good Match - Number of bases on 3' end of primers where at least 2 out of 3 bases match. \n"
"Flip Reverse Primer - Invert the sequence order of the reverse primer and complement it. \n"
"\n"
"
Output
\n"
"When successful, the search returns a sequence output file in fasta format \n"
"containing all sequence in the database that lie between and include the \n"
"primer pair. The fasta header describes the region in the database\n"
"and the primers. The fasta body is capitalized in areas where the primer\n"
"sequence matches the database sequence and in lower-case elsewhere. Here\n"
"is an example from human: \n"
"