a1d7c07c50f1d895337de121680ea672b261c058 max Mon Aug 17 02:26:36 2026 -0700 escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch. diff --git src/hg/hgHubConnect/hgHubConnect.c src/hg/hgHubConnect/hgHubConnect.c index b2a8085c088..65d37febc54 100644 --- src/hg/hgHubConnect/hgHubConnect.c +++ src/hg/hgHubConnect/hgHubConnect.c @@ -472,31 +472,31 @@ } void hgHubConnectDeveloperMode() /* Put up the controls for the "Hub Development" Tab, which includes a button to run the * hubCheck utility on a hub and load a hub with the udcTimeout and measureTiming * variables turned on */ { // put out the top of our page char *hubUrl = cartOptionalString(cart, "validateHubUrl"); // the outer div for all the elements in the tab puts("<div id=\"hubDeveloper\" class=\"hubList\">"); char *hubUrlVal = ""; if (hubUrl != NULL) - hubUrlVal = catThreeStrings(" value='", hubUrl, "'"); + hubUrlVal = catThreeStrings(" value='", htmlEncode(hubUrl), "'"); puts("<div class='tabSection'>"); puts("<h4>Create your own hub</h4>"); puts("For information on making track hubs, see the following pages: \n " "<ul>\n" "<li><a href='/docs/hubs/hubBasics.html' style='color:#121E9A' target=_blank>Track Hub Basics</a></li>\n" "<li><a href=\"../goldenPath/help/hgTrackHubHelp.html\" style='color:#121E9A' TARGET=_blank>Track Hub User's Guide</a></li>\n" "<li><a href=\"../goldenPath/help/hgTrackHubHelp#Hosting\" style='color:#121E9A' target=_blank>Where to Host Your Track Hub</a></li>\n" "<li><a href=\"../goldenPath/help/trackDb/trackDbHub.html\" style='color:#121E9A' target=_blank>Track Hub Settings Reference</a></li>\n" "<li><a href=\"../goldenPath/help/publicHubGuidelines.html\" style='color:#121E9A' target=_blank>Guidelines for Submitting a Public Hub</a></li>\n" "</ul>\n" "<BR>You may also <a href='../contacts.html' style='color:#121E9A'>contact us</a> if you have any " "issues or questions on hub development."); puts("</div>"); // .tabSection @@ -577,40 +577,40 @@ void printSearchAndFilterBoxes(int searchEnabled, char *hubSearchTerms, char *dbFilter) /* Create the text boxes for search and database filtering along with the required * javscript */ { printf("<FORM ACTION=\"%s\" NAME=\"searchHubForm\">\n", "../cgi-bin/hgHubConnect"); if (searchEnabled) { cgiMakeHiddenVar(hgHubDoSearch, "on"); cgiMakeHiddenVar(hgHubDbFilter, ""); cartSaveSession(cart); printf("The list below can be filtered on words in the hub description pages or by assemblies.<BR>" "Search terms: " "<input name=\"hubSearchTerms\" id=\"hubSearchTerms\" class=\"hubField\" " "placeholder='e.g. methylation' type=\"text\" size=\"50\" value=\"%s\"> \n", - hubSearchTerms!=NULL?hubSearchTerms:""); + hubSearchTerms!=NULL?htmlEncode(hubSearchTerms):""); printf("\n"); } printf("Assembly: " "<input name=\"%s\" id=\"hubDbFilter\" class=\"hubField\" " "type=\"text\" size=\"15\" value=\"%s\" placeholder='e.g. hg38'> \n" "<input name=\"hubSearchButton\" id='hubSearchButton' " "class=\"hubField\" type=\"submit\" value=\"Search Public Hubs\">\n", - hgHubDbFilter, dbFilter!=NULL?dbFilter:""); + hgHubDbFilter, dbFilter!=NULL?htmlEncode(dbFilter):""); puts("</FORM>"); } void printSearchTerms(char *hubSearchTerms) /* Write out a reminder about the current search terms and a note about * how to navigate detailed search results */ { printf("Displayed list <B>restricted by above search terms</B> \n"); puts("<input name=\"hubDeleteSearchButton\" id='hubDeleteSearchButton' " "class=\"hubField\" type=\"button\" value=\"Show All Hubs\">\n"); jsOnEventById("click", "hubDeleteSearchButton", "document.searchHubForm.elements['hubSearchTerms'].value='';" "document.searchHubForm.elements['hubDbFilter'].value='';" @@ -1627,31 +1627,31 @@ puts("<div id='content' style='margin:10px; padding: 2px'>"); jsOnEventByIdF("click", "windowX", "closeIframe()"); if (isEmpty(hubUrl)) printf("Please wait, loading and checking hub. This usually takes a minute or two but can take up to 20 minutes for big hubs."); else { puts("<p><button id='reloadButton'>Check again</button>"); puts(" <button id='closeButton'>Close this window</button></p>"); jsOnEventByIdF("click", "reloadButton", "reloadIframe()"); jsOnEventByIdF("click", "closeButton", "closeIframe()"); jsInline("document.onkeydown = function(evt) { if (evt.keyCode===27) { closeIframe() } };"); int retVal = doValidateNewHub(hubUrl); if (retVal == 0) - printf("<div>Finished checking %s</div>", hubUrl); + printf("<div>Finished checking %s</div>", htmlEncode(hubUrl)); puts("<hr>"); puts("<p>More information about <b>hub settings</b> can be found on the " "<a target=_blank href='https://genome.ucsc.edu/goldenPath/help/trackDb/trackDbHub.html'>Hub Track Database Definition</a> page."); puts("<p>Our command line tool <a target=_blank href='https://hgdownload.soe.ucsc.edu/downloads.html#utilities_downloads'>hubCheck</a> " "can be used to obtain the same output from a Unix command line.</p>"); puts("<p>To download the hubCheck tool for Linux, run these commands" " (replace 'linux' with 'macOSX' on a x86 Mac):<br>" "<pre>wget http://hgdownload.cse.ucsc.edu/admin/exe/linux.x86_64/hubCheck\n" "chmod a+x hubCheck\n" "hubCheck https://genome.ucsc.edu/goldenPath/help/examples/hubDirectory/hub.txt</pre></p>"); puts("<p>You can use the 'Esc' key to close this window.</p>"); } puts("</div>"); // margin 10px puts("</div>"); // ui-dialog-titlebar puts("</div>"); // ui-dialog