e035146f3dc0ce0eaac009b1a37b416b31b068ea galt Wed Aug 1 13:37:07 2018 -0700 refs #21729. Added CSP and nonce and javascript-separation routines to the Python library hgLib in PyLib. Changed hgGeneGraph to use those functions and stop XSS attacks. Modified commit for demonstration. diff --git src/hg/hgGeneGraph/hgGeneGraph src/hg/hgGeneGraph/hgGeneGraph index 9ac9129..c6a271b 100755 --- src/hg/hgGeneGraph/hgGeneGraph +++ src/hg/hgGeneGraph/hgGeneGraph @@ -28,32 +28,32 @@ # ggLinkEvent (details about link), ggEventDb (details about links from databases), # ggEventText (details about links from text mining), ggDoc (details about documents for ggEventText) # ggGeneName (symbols), ggGeneClass (HPRD/Panther class) # these are default python modules on python 2.7, no errors expected here import sys, cgi, os, string, urllib, operator, hashlib from sys import exit from collections import defaultdict, namedtuple from os.path import * # import the UCSC-specific library sys.path.append(join(dirname(__file__), "pyLib")) try: from hgLib import cgiArgs, cgiSetup, cgiString, printContentType, printMenuBar, \ sqlConnect, sqlQuery, errAbort, cfgOption, runCmd, cgiGetAll, printHgcHeader, \ - printHgcSection, webStartGbNoBanner, htmlPageEnd, hConnectCentral, sqlTableExists, \ - readSmallFile + printHgcSection, getNonce, getCspMetaHeader, jsOnEventById, jsInlineFinish, webStartGbNoBanner, htmlPageEnd, hConnectCentral, sqlTableExists, \ + readSmallFil except: print("Content-type: text/html\n") print("Cannot find the directory cgi-bin/pyLib in Apache. This is an installation error.") print("All all parts of cgi-bin installed? Did you do 'make' in kent/src/hg/pyLib?") import MySQLdb # not using feedback button for now. Fan would have liked it, but not sure how we can write # to any form of database. # the list of allowed chars in cgi args: digits, letters and dashes legalChars = set(string.digits) legalChars.update(set(string.letters)) legalChars.update("_-./: ") @@ -133,31 +133,31 @@ # # # # # # def printInlineAndStyles(): #print('') print('') print(""" -