a1d7c07c50f1d895337de121680ea672b261c058
max
  Mon Aug 17 02:26:36 2026 -0700
escape reflected/echoed user input across several CGIs (XSS), refs #38057

Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text),
cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string
literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer.
Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene,
hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui,
hgPhyloPlace, hgMirror, hgCustom and hgSearch.

diff --git src/hg/hgMirror/hgMirror src/hg/hgMirror/hgMirror
index 52e1151f059..850593730dc 100755
--- src/hg/hgMirror/hgMirror
+++ src/hg/hgMirror/hgMirror
@@ -1767,31 +1767,31 @@
 
         revokedTracks = getRevokedTracks(db)
         addPredefined(trackVis, superTracks, groupList, groupToTopTracks, trackLabels, trackChildren, \
             tableToGbdbFiles, trackTables, tableSizes, revokedTracks)
 
         listFname, gbdbFname, fixedFname = makeTableFileList(jobId, db, trackList, trackTables, trackChildren, \
                                         tableToGbdbFiles, tableSizes, forceTables, noTableTracks, gbdbSizes)
         runRsyncJobs(jobId, db, listFname, gbdbFname, fixedFname)
         refreshPage("jobId=%d" % jobId, addNote=True)
 
     # show list of files if told to do so
     elif "showFiles" in args.keys() and "db" in args.keys():
         revokedTracks = getRevokedTracks(db)
         addPredefined(trackVis, superTracks, groupList, groupToTopTracks, trackLabels, trackChildren, \
             tableToGbdbFiles, trackTables, tableSizes, revokedTracks)
-        trackName = args["showFiles"].value
+        trackName = mustBeClean(args["showFiles"].value)  # sanitize like other params, before echoing into HTML (XSS)
         tables, gbdbFiles = trackToFiles(trackName, trackTables, trackChildren, \
                 tableSizes, tableToGbdbFiles, noTableTracks, gbdbSizes)
 
         totalSize = 0
 
         print "<h4>MySQL tables linked to %s</h4>" % trackName
         for table in tables:
             if table not in tableSizes:
                 continue
             size = tableSizes[table]
             sizeStr = humanReadable(size)
             totalSize += size
             print table+" (%s) <br>" % sizeStr
         
         print "<h4>GBDB files linked to %s</h4>" % trackName