074ea922bc80e0c46b93fb22b91426770022e4e2
braney
  Tue Aug 18 10:59:40 2026 -0700
lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123

diff --git src/hg/lib/hui.c src/hg/lib/hui.c
index e7e26e49800..982ef64ad30 100644
--- src/hg/lib/hui.c
+++ src/hg/lib/hui.c
@@ -6090,31 +6090,31 @@
 
 char defaultColor[16];
 safef(defaultColor, sizeof(defaultColor), "#%02x%02x%02x", tdb->colorR, tdb->colorG, tdb->colorB);
 
 char *rawCartValue = cartOptionalString(cart, varName);
 boolean hasOverride = (rawCartValue != NULL && rawCartValue[0] != '\0');
 char *colorValue = hasOverride ? rawCartValue : defaultColor;
 
 char checkVar[1024];
 safef(checkVar, sizeof(checkVar), "%s.colorOverrideOn", name);
 boolean isOn = cartUsualBoolean(cart, checkVar, hasOverride);
 
 printf("<br><b>Override track color:</b> ");
 cgiMakeCheckBox(checkVar, isOn);
 printf(" <input type='text' name='%s' id='%s_text' value='%s' size='8' />",
-    varName, varName, htmlEncode(colorValue)); // colorValue may be a cart override, escape (XSS)
+    varName, varName, htmlEncode(colorValue)); // colorValue may be a cart override, escape
 printf("&nbsp;<input id='%s_picker' />\n", varName);
 jsInlineF(
     "(function() {\n"
     "  var textEl = document.getElementById('%s_text');\n"
     "  var pickerEl = document.getElementById('%s_picker');\n"
     "  var checkEl = document.querySelector('input[type=checkbox][name=\"%s\"]');\n"
     "  $(pickerEl).spectrum({\n"
     "    color: textEl.value,\n"
     "    showPalette: true,\n"
     "    showSelectionPalette: true,\n"
     "    showInitial:true,\n"
     "    showInput: true,\n"
     "    preferredFormat: 'hex',\n"
     "    hideAfterPaletteSelect: true,\n"
     "    change: function(color) { textEl.value = color.toHexString(); checkEl.checked = true; }\n"