a1d7c07c50f1d895337de121680ea672b261c058
max
  Mon Aug 17 02:26:36 2026 -0700
escape reflected/echoed user input across several CGIs (XSS), refs #38057

Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text),
cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string
literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer.
Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene,
hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui,
hgPhyloPlace, hgMirror, hgCustom and hgSearch.

diff --git src/hg/hgGenome/configure.c src/hg/hgGenome/configure.c
index 97f0fb9b7e7..ef968519047 100644
--- src/hg/hgGenome/configure.c
+++ src/hg/hgGenome/configure.c
@@ -1,19 +1,20 @@
 /* Copyright (C) 2011 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 
 #include "common.h"
+#include "htmshell.h"
 #include "hash.h"
 #include "jksql.h"
 #include "hCommon.h"
 #include "cart.h"
 #include "cheapcgi.h"
 #include "chromGraph.h"
 #include "web.h"
 #include "hPrint.h"
 #include "hui.h"
 #include "hgGenome.h"
 
 
 void makeNumMenu(char *varName, int minVal, int maxVal, int defaultVal)
 /* Make a drop down menu with a limited number of numerical choices. */
 {
@@ -96,55 +97,55 @@
 hTableStart();
 hPrintf("<TR><TH>name</TH>");
 hPrintf("<TH>description</TH></TR>");
 struct slRef *ref;
 for (ref = ggList; ref != NULL; ref = ref->next)
     {
     struct genoGraph *gg = ref->val;
     /* Only show custom graphs, stand-alone DB graphs, and composite */
     /* graphs.  Don't show subGraphs part of a composite. */
     if (gg->isSubGraph == FALSE)
 	{
 	char *tmp = cgiEncode(gg->name);
 	hPrintf("<TR><TD><A HREF=\"../cgi-bin/hgGenome?%s&%s=on&g=%s\">",
 		cartSidUrlString(cart), hggConfigureOne, tmp);
 	freeMem(tmp);
-	hPrintf("%s</A></TD>", gg->shortLabel);
-	hPrintf("<TD>%s</TD></TR>\n", gg->longLabel);
+	hPrintf("%s</A></TD>", htmlEncode(gg->shortLabel)); // user graph label, escape (XSS)
+	hPrintf("<TD>%s</TD></TR>\n", htmlEncode(gg->longLabel));
 	}
     }
 hTableEnd();
 cartWebEnd();
 }
 
 void configureOnePage()
 /* Put up configuration for one graph. */
 {
 /* Figure out which graph we're configuring. */
 char *graphName = cartString(cart, "g");
 struct genoGraph *gg = hashFindVal(ggHash, graphName);
 if (gg == NULL)
     {
     /* Warn/return rather than abort if have problems, so that 
      * cartRemovePrefix(hggDo) is executed to keep us from error
      * loop forever... */
     warn("Graph %s not found", graphName);
     return;
     }
 
 /* Put up web page with controls */
-cartWebStart(cart, database, "Configure %s", gg->shortLabel);
+cartWebStart(cart, database, "Configure %s", htmlEncode(gg->shortLabel));
 hPrintf("<FORM ACTION=\"../cgi-bin/hgGenome\" METHOD=GET>\n");
 cartSaveSession(cart);
 cgiMakeHiddenVar(hggConfigure, "on");
 struct chromGraphSettings *cgs = gg->settings;
 char varName[chromGraphVarNameMaxSize];
 chromGraphVarName(gg->name, "minVal", varName);
 hPrintf("display min value: ");
 cartMakeIntVar(cart, varName, cgs->minVal, 5);
 chromGraphVarName(gg->name, "maxVal", varName);
 hPrintf(" max value: ");
 cartMakeIntVar(cart, varName, cgs->maxVal, 5);
 hPrintf("<BR>\n");
 hPrintf("draw connecting lines between markers separated by up to ");
 chromGraphVarName(gg->name, "maxGapToFill", varName);
 cartMakeIntVar(cart, varName, cgs->maxGapToFill, 8);