9ad04e0a0b06ec3c4f09ef1b6c3ce6be79b61c68
braney
  Sun Aug 16 11:56:56 2026 -0700
cart: validate file names read back out of the cart

Several cart variables hold the name of a file the server created for a user.
Route them through one shared check, isServerUserFilePath(), which accepts the
trash directory, the session-data directories and myVariantsDataDir, and apply
it both where values enter the cart and where the file names are used.

A few of these variables may instead hold a remote URL.  Those get their own
list and isServerUserFileOrUrl(), because the code that reads them chooses
between a fetch and a local open by looking for a protocol.

Consolidates two hand-rolled copies of the same test in blatShare.c and
customFactory.c, and drops the weaker private copy in sessionData.c.

Adds hg/utils/cartFileVarCatalog, a registry that scans the tree for a cart
value reaching a file call and reconciles what it finds against the lists in
cart.c, so a new one of these cannot be added without somebody noticing.  Its
--reconcile is quiet enough for the nightly cron the other catalogs use, and it
is what turned up seven of the names now on those lists.

refs #37623

diff --git src/hg/near/hgNear/customColumn.c src/hg/near/hgNear/customColumn.c
index 79b171f9a2a..42c639f886c 100644
--- src/hg/near/hgNear/customColumn.c
+++ src/hg/near/hgNear/customColumn.c
@@ -1,40 +1,41 @@
 /* customColumn - handle columns put in by users. */
 
 /* Copyright (C) 2012 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 
 #include "common.h"
 #include "linefile.h"
 #include "hash.h"
 #include "localmem.h"
 #include "cheapcgi.h"
 #include "obscure.h"
 #include "portable.h"
 #include "net.h"
 #include "cart.h"
 #include "hgNear.h"
+#include "trashDir.h"
 
 static char *customFileName()
 /* Return file name associated with custom column if any.
  * Delete cart var if it's grown stale. */
 {
 char *fileName = NULL;
 if (cartVarExists(cart, customFileVarName))
     {
     fileName = cartString(cart, customFileVarName);
-    if (!fileExists(fileName))
+    if (!isServerUserFilePath(fileName) || !fileExists(fileName))
 	{
         cartRemove(cart, customFileVarName);
 	fileName = NULL;
 	}
     }
 return fileName;
 }
 
 static char *newCustomFileName()
 /* Create new custom file name. */
 {
 struct tempName tn;
 makeTempName(&tn, "near", ".col");
 return cloneString(tn.forCgi);
 }