b03051dec6a7b9d132995e809f378bc3277a987a
max
  Thu Aug 27 01:18:06 2026 -0700
escape search terms and uploaded sequence names (XSS), refs #38057

#Preview2 week - bugs introduced now will need a build patch to fix
#Preview2 week - bugs introduced now will need a build patch to fix
Follow-up to the QA review of dbd10edb43b.

hgFileSearch and hgTracks track search: the name/description/simple search
boxes echoed the search term into a value attribute unescaped.  The earlier
pass escaped the hgFileSearch simple box only, which sits inside a
USE_TABS block that is not compiled.

hgPhyloPlace: uploaded sequence names are echoed in the QC failure
messages from vcfFromFasta, in the subtree summary table, in the
placement and mutation-path headings, in the subtree download links and
in the no-reference-match list.  All now go through htmlEncode.

hgLiftOver: the failure file was read back while its FILE* was still
open and unflushed, so the "Failed input regions" block always came out
empty.  Close mapped and unmapped right after liftOver writes them.

diff --git src/hg/hgFileSearch/hgFileSearch.c src/hg/hgFileSearch/hgFileSearch.c
index 59d918f045e..eca9ba34f4d 100644
--- src/hg/hgFileSearch/hgFileSearch.c
+++ src/hg/hgFileSearch/hgFileSearch.c
@@ -227,67 +227,67 @@
        FILE_SEARCH_CURRENT_TAB, currentTab);
 printf("<div id='tabs' style='display:none; %s'>\n"
        "<ul>\n"
        "<li><a href='#simpleTab'><B style='font-size:.9em;font-family: arial, Geneva, "
        "Helvetica, san-serif;'>Search</B></a></li>\n"
        "<li><a href='#filesTab'><B style='font-size:.9em;font-family: arial, Geneva, "
        "Helvetica, san-serif;'>Files</B></a></li>\n"
        "</ul>\n",cgiBrowser()==btIE?"width:1060px;":"max-width:inherit;");
 
 // Files tab
 printf("<div id='simpleTab' style='max-width:inherit;'>\n");
 
 printf("<table id='simpleTable' style='width:100%%; font-size:.9em;'><tr><td colspan='2'>");
 printf("<input type='text' name='%s' id='simpleSearch' class='submitOnEnter' value='%s' "
        "style='max-width:1000px; width:100%%;'>\n",
-       TRACK_SEARCH_SIMPLE,descSearch == NULL ? "" : htmlEncode(descSearch)); // search string into attr, escape (XSS)
+       TRACK_SEARCH_SIMPLE,descSearch == NULL ? "" : htmlEncode(descSearch)); // escape (XSS)
 jsOnEventById("keyup", "simpleSearch", "findTracks.searchButtonsEnable(true);");
 
 printf("</td></tr><td style='max-height:4px;'></td></tr></table>");
 printf("<input type='submit' name='%s' id='searchSubmit' value='search' style='font-size:.8em;'>\n",
        FILE_SEARCH);
 printf("<input type='button' name='clear' id='clear' value='clear' class='clear' style='font-size:.8em;'>\n");
 jsOnEventById("click","clear","findTracks.clear();");
 printf("<input type='submit' name='submit' value='cancel' class='cancel' "
        "style='font-size:.8em;'>\n");
 printf("</div>\n");
 #endif///def USE_TABS
 
 // Files tab
 printf("<div id='filesTab' style='width:inherit;'>\n"
         "<table id='filesTable' cellSpacing=0 style='width:inherit; font-size:.9em;'>\n");
 cols = 8;
 
 // Track Name contains
 printf("<tr><td colspan=3></td>");
 printf("<td nowrap><b style='max-width:100px;'>Track&nbsp;Name:</b></td>");
 printf("<td align='right'>contains</td>\n");
 printf("<td colspan='%d'>", cols - 4);
 printf("<input type='text' name='%s' id='nameSearch' class='submitOnEnter' value='%s' "
        "style='min-width:326px; font-size:.9em;'>",
-       TRACK_SEARCH_ON_NAME, nameSearch == NULL ? "" : nameSearch);
+       TRACK_SEARCH_ON_NAME, nameSearch == NULL ? "" : htmlEncode(nameSearch)); // escape (XSS)
 jsOnEventById("keyup", "nameSearch", "findTracks.searchButtonsEnable(true);"); 
 printf("</td></tr>\n");
 
 // Description contains
 printf("<tr><td colspan=2></td><td align='right'>and&nbsp;</td>");
 printf("<td><b style='max-width:100px;'>Description:</b></td>");
 printf("<td align='right'>contains</td>\n");
 printf("<td colspan='%d'>", cols - 4);
 printf("<input type='text' name='%s' id='descSearch' value='%s' class='submitOnEnter' "
        "style='max-width:536px; width:536px; font-size:.9em;'>",
-       TRACK_SEARCH_ON_DESCR, descSearch == NULL ? "" : descSearch);
+       TRACK_SEARCH_ON_DESCR, descSearch == NULL ? "" : htmlEncode(descSearch)); // escape (XSS)
 jsOnEventById("keyup", "descSearch", "findTracks.searchButtonsEnable(true);");
 printf("</td></tr>\n");
 
 // Set up Group dropdown
 struct grp *grps = hLoadGrps(db);
 grps = groupsFilterForTdbList(&grps,tdbList);
 int numGroups = slCount(grps) + 1; // Add Any
 char **groups = needMem(sizeof(char *) * numGroups);
 char **labels = needMem(sizeof(char *) * numGroups);
 groups[0] = ANYLABEL;
 labels[0] = ANYLABEL;
 int ix=1;
 struct grp *grp = grps;
 for (; grp != NULL; grp = grp->next,ix++)
     {