20ca104b9897669e127e4ec8675321b12f780cff
braney
  Tue Aug 18 11:19:44 2026 -0700
lib, hgTracks: encode JSON object keys and configure/search text, refs #38123

diff --git src/hg/hgTracks/searchTracks.c src/hg/hgTracks/searchTracks.c
index 5ed216cd817..9965365a093 100644
--- src/hg/hgTracks/searchTracks.c
+++ src/hg/hgTracks/searchTracks.c
@@ -1038,40 +1038,42 @@
 // NOTE: This is necessary when container cfg by '*' results in vis changes
 // This will handle composite/view override when subtrack specific vis exists,
 // AND superTrack reshaping.
 
 // Subtrack settings must be removed when composite/view settings are updated
 parentChildCartCleanup(trackList,cart,oldVars);
 
 slSort(&groupList, gCmpGroup);
 struct hash *superHash = hashNew(8);
 for (group = groupList; group != NULL; group = group->next)
     {
     groupTrackListAddSuper(cart, group, superHash, trackHash);
     if (group->trackList != NULL)
         {
         groups[numGroups] = cloneString(group->name);
-        labels[numGroups] = cloneString(group->label);
+        // a hub group's label is built from the hub's shortLabel and its groups.txt label
+        labels[numGroups] = htmlEncode(group->label);
         numGroups++;
         if (numGroups >= ArraySize(groups))
             internalErr();
         }
     }
 hashFree(&superHash);
 
+// on an assembly hub the organism and the freeze name both come from the hub
 safef(buf, sizeof(buf),"Search for Tracks in the %s %s Assembly",
-      organism, hFreezeFromDb(database));
+      htmlEncode(organism), htmlEncode(hFreezeFromDb(database)));
 webStartWrapperDetailedNoArgs(cart, database, "", buf, FALSE, FALSE, FALSE, FALSE);
 
 hPrintf("<div style='max-width:1080px;'>");
 hPrintf("<form action='%s' name='%s' id='%s' method='get'>\n\n",
         hgTracksName(),TRACK_SEARCH_FORM,TRACK_SEARCH_FORM);
 cartSaveSession(cart);  // Creates hidden var of hgsid to avoid bad voodoo
 safef(buf, sizeof(buf), "%lu", clock1());
 cgiMakeHiddenVar("hgt_", buf);  // timestamps page to avoid browser cache
 
 
 hPrintf("<input type='hidden' name='db' value='%s'>\n", database);
 hPrintf("<input type='hidden' name='%s' id='currentTab' value='%s'>\n",
         TRACK_SEARCH_CURRENT_TAB, currentTab);
 hPrintf("<input type='hidden' name='%s' value=''>\n",TRACK_SEARCH_DEL_ROW);
 hPrintf("<input type='hidden' name='%s' value=''>\n",TRACK_SEARCH_ADD_ROW);