src/hg/phyloPng/phyloPng.c a1d7c07c50f1d895337de121680ea672b261c058

a1d7c07c50f1d895337de121680ea672b261c058
max
  Mon Aug 17 02:26:36 2026 -0700
escape reflected/echoed user input across several CGIs (XSS), refs #38057

Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text),
cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string
literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer.
Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene,
hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui,
hgPhyloPlace, hgMirror, hgCustom and hgSearch.

diff --git src/hg/phyloPng/phyloPng.c src/hg/phyloPng/phyloPng.c
index ba4124b7951..a7fb6cdaff9 100644
--- src/hg/phyloPng/phyloPng.c
+++ src/hg/phyloPng/phyloPng.c
@@ -453,31 +453,31 @@
 	puts("</td><td><textarea name=\"phyloPng_tree\" rows=14 cols=70>");
 	if (NULL == phyloData || phyloData[0] == '\0' || cgiVarExists("phyloPng_restore"))
 	    {
 	    puts(
 "(((((Human:0.00655,\n"
 "    Chimp:0.00684):0.027424,\n"
 "   Rhesus:0.037601):0.109934,\n"
 "  (Mouse:0.084509,\n"
 "  Rat:0.091589):0.271974):0.020593,\n"
 " Dog:0.165928):0.258392,\n"
 "Opossum:0.340786);\n"
 		);
 	    }
 	else
 	    {
-	    printf("%s",phyloData);
+	    printf("%s",htmlEncode(phyloData)); // user tree in textarea, escape (XSS)
 	    }
 	puts("</TEXTAREA>");
 	puts("</td></tr>");
 	puts("<tr><td>&nbsp;</td><td>");
 	puts("<INPUT type=\"submit\" name=\"phyloPng_submit\" value=\"submit\">");
 	cgiMakeClearButtonNoSubmit("mainForm", "phyloPng_tree");
 	puts("</td></tr>");
 	puts("</table>");
 	puts("</form>");
 	webNewSection("Notes");
     	puts(
 "\n"
 "1. Length-ruler and length-values cannot be shown unless use-branch-lengths is also checked.<br>\n"
 "<br>\n"
 "2. If \"Strip underscore-suffixes?\" is checked, underscores and anything following them are stripped from node labels.<br>\n"
@@ -544,31 +544,31 @@
 	return 0;
 	}
     else	    
     	usage("-phyloPng_tree is a required 'option' or cgi variable.");
     }
 
 if (htmlPageWrapper)
     {
     printf("Content-type: text/html\r\n");
     printf("\r\n");
     printf("<html><head>\n%s<title>Phylogenetic Tree</title></head><body>",getCspMetaHeader());
     printf("<IMAGE SRC=\"http://%s%s"
 	    "?phyloPng_width=%d"
 	    "&phyloPng_height=%d"
 	    "&phyloPng_tree=%s"
-	,getenv("SERVER_NAME"),getenv("SCRIPT_NAME"),width,height,phyloData);
+	,getenv("SERVER_NAME"),getenv("SCRIPT_NAME"),width,height,cgiEncode(phyloData)); // tree into URL, cgiEncode (XSS)
     if (branchLengths)
 	printf("&phyloPng_branchLengths=1");
     if (lengthLegend)
 	printf("&phyloPng_lengthLegend=1");
     if (branchLabels)
 	printf("&phyloPng_branchLabels=1");
     printf("&phyloPng_branchDecimals=%d",branchDecimals);
     printf("&phyloPng_branchMultipliers=%d",branchMultiplier);
     if (stripUnderscoreSuff)
 	printf("&phyloPng_underscores=1");
     if (dashToSpace)
 	printf("&phyloPng_dash_to_space=1");
     if (underToSpace)
 	printf("&phyloPng_under_to_space=1");
     if (monospace)