a4befd9382fadf413884d2215012535d5d667063
braney
  Mon Aug 17 13:46:45 2026 -0700
hgApi, hgTracks: tighten callback parameter validation, refs #38126 #38057

Add isValidJsonpCallback() and apply it to the callback-name paths in
apiOut() and the hgTracks jsonp output, so only C-symbol dotted names are
echoed back.

diff --git src/hg/cgilib/api.c src/hg/cgilib/api.c
index 58a0584ee06..a94c48768c2 100644
--- src/hg/cgilib/api.c
+++ src/hg/cgilib/api.c
@@ -1,24 +1,26 @@
 /* Utility functions for web API programs */
 
 /* Copyright (C) 2014 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 
 #include "common.h"
+#include "cheapcgi.h"
 #include "api.h"
 
 void apiOut(char *text, char *jsonp)
 /* Output content header and text to stdout */
 {
 // It's debatable whether the type should be text/plain, text/javascript or application/javascript;
 // text/javascript works with all our supported browsers, so we are using that one.
 puts("Content-Type:text/javascript\n");
 
-if (jsonp)
+if (jsonp && isValidJsonpCallback(jsonp))
     {
     printf("%s(%s)", jsonp, text);
     }
 else
     {
+    // No callback, or an invalid callback name: emit the bare (unpadded) JSON.
     puts(text);
     }
 }