a1d7c07c50f1d895337de121680ea672b261c058 max Mon Aug 17 02:26:36 2026 -0700 escape reflected/echoed user input across several CGIs (XSS), refs #38057 Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text), cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer. Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene, hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui, hgPhyloPlace, hgMirror, hgCustom and hgSearch. diff --git src/hg/phyloPng/phyloPng.c src/hg/phyloPng/phyloPng.c index ba4124b7951..a7fb6cdaff9 100644 --- src/hg/phyloPng/phyloPng.c +++ src/hg/phyloPng/phyloPng.c @@ -453,31 +453,31 @@ puts(""); puts(""); puts(" "); puts(""); cgiMakeClearButtonNoSubmit("mainForm", "phyloPng_tree"); puts(""); puts(""); puts(""); webNewSection("Notes"); puts( "\n" "1. Length-ruler and length-values cannot be shown unless use-branch-lengths is also checked.
\n" "
\n" "2. If \"Strip underscore-suffixes?\" is checked, underscores and anything following them are stripped from node labels.
\n" @@ -544,31 +544,31 @@ return 0; } else usage("-phyloPng_tree is a required 'option' or cgi variable."); } if (htmlPageWrapper) { printf("Content-type: text/html\r\n"); printf("\r\n"); printf("\n%sPhylogenetic Tree",getCspMetaHeader()); printf("