a1d7c07c50f1d895337de121680ea672b261c058
max
  Mon Aug 17 02:26:36 2026 -0700
escape reflected/echoed user input across several CGIs (XSS), refs #38057

Route user-, DB- and hub-derived values through htmlEncode (HTML/attribute text),
cgiEncode (values composed into URLs), jsonStringEscape (values placed in a JS string
literal inside an inline script) or, for hgMirror, the existing mustBeClean sanitizer.
Covers hgHubConnect, hgUserSuggestion, hgLiftOver, hgBlat, hgc pubs, hgVisiGene,
hgSession, hgTrackUi, hgGenome, phyloPng, hgFileSearch, hgLinkIn, hgPal, hui,
hgPhyloPlace, hgMirror, hgCustom and hgSearch.

diff --git src/hg/hgPal/hgPal.c src/hg/hgPal/hgPal.c
index cfbfca964b8..25e466fcbb0 100644
--- src/hg/hgPal/hgPal.c
+++ src/hg/hgPal/hgPal.c
@@ -1,67 +1,68 @@
 /* hgPal - URL entry point to library pal routines */
 
 /* Copyright (C) 2013 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 #include "common.h"
+#include "htmshell.h"
 #include "cart.h"
 #include "cheapcgi.h"
 #include "web.h"
 #include "hdb.h"
 #include "hui.h"
 #include "pal.h"
 
 
 char *excludeVars[] = {"Submit", "submit", NULL,};
 
 void addOurButtons()
 {
 cgiMakeButton("Submit", "Submit");
 }
 
 void doMiddle(struct cart *cart)
 /* Set up globals and make web page */
 {
 char *track = cartString(cart, "g");
 char *chrom = cartOptionalString(cart, "c");
 char *item = cartOptionalString(cart, "i");
 int start = cartInt(cart, "l");
 int end = cartInt(cart, "r");
 char *database;
 char *genome;
 
 getDbAndGenome(cart, &database, &genome, NULL);
 struct sqlConnection *conn = hAllocConn(database);
-cartWebStart(cart, database, "Other Species Alignments for %s %s",track,item);
+cartWebStart(cart, database, "Other Species Alignments for %s %s",htmlEncode(track),htmlEncode(item)); // user input into title, escape (XSS)
 
 /* output the option selection dialog */
 palOptions(cart, conn, addOurButtons, NULL);
 
 printf("For information about output data format see the "
   "<A HREF=\"../goldenPath/help/hgTablesHelp.html#FASTA\">User's Guide</A><BR>");
 
 struct bed *bed;
 AllocVar(bed);
 bed->name = item;
 bed->chromStart = start;
 bed->chromEnd = end;
 bed->chrom = chrom;
 
 printf("<pre>");
 /* output the alignments */
 int result =palOutPredsInBeds(conn, cart, bed, track);
 printf("</pre>");
 if (result == 0)
-    printf("<B>No coding region in gene '%s'</B><BR>",item);
+    printf("<B>No coding region in gene '%s'</B><BR>",htmlEncode(item));
 
 cartHtmlEnd();
 }
 
 int main(int argc, char *argv[])
 /* Process command line. */
 {
 long enteredMainTime = clock1000();
 cgiSpoof(&argc, argv);
 cartEmptyShell(doMiddle, hUserCookie(), excludeVars, NULL);
 cgiExitTime("hgPal", enteredMainTime);
 return 0;
 }