074ea922bc80e0c46b93fb22b91426770022e4e2
braney
  Tue Aug 18 10:59:40 2026 -0700
lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123

diff --git src/lib/cheapcgi.c src/lib/cheapcgi.c
index 8adfa653083..7a6dfaad854 100644
--- src/lib/cheapcgi.c
+++ src/lib/cheapcgi.c
@@ -1907,31 +1907,32 @@
                                  char *id, char *moreHtml)
 /* Make check box - designed to be called by the variously overloaded
  * cgiMakeCheckBox functions, and should NOT be called directly.
  * moreHtml: optional additional html like javascript call or mouseover msg (may be NULL)
  * id: button id (may be NULL)
  * Also make a shadow hidden variable and support 2 boolean states:
  *    checked/unchecked and enabled/disabled. */
 {
 char buf[256], idBuf[256], shadId[256];
 
 if(id)
     safef(idBuf, sizeof(idBuf), " id=\"%s\"", id);
 else
     idBuf[0] = 0;
 
-printf("<INPUT TYPE=CHECKBOX NAME=\"%s\"%s VALUE=on %s%s%s>", name, idBuf,
+// name can carry a hub-supplied string (a bigBed field name from labelFields), escape
+printf("<INPUT TYPE=CHECKBOX NAME=\"%s\"%s VALUE=on %s%s%s>", htmlEncode(name), idBuf,
         (moreHtml ? moreHtml : ""),
         (checked ? " CHECKED" : ""),
         (enabled ? "" : " DISABLED"));
 safef(buf, sizeof(buf), "%s%s", cgiBooleanShadowPrefix(), name);
 if (id)
     safef(shadId, sizeof(shadId), "%s%s", cgiBooleanShadowPrefix(), id);
 cgiMakeHiddenVarWithIdExtra(buf, id ? shadId : NULL, ( enabled ? "0" : (checked ? "-1" : "-2")),BOOLSHAD_EXTRA);
 }
 
 void cgiMakeCheckBoxUtil(char *name, boolean checked, char *msg, char *id)
 /* Make check box - can be called directly, though it was originally meant
  * as the common code for all lower level checkbox routines.
  * However, it's util functionality has been taken over by
  * cgiMakeCheckBoxWithIdAndOptionalHtml() */
 {
@@ -2280,31 +2281,32 @@
 
 if (class)
     printf(" class='%s'", class);
 
 if (events)
     {
     struct slPair *e;
     for(e = events; e; e = e->next)
 	{
 	jsOnEventById(e->name, id, e->val);
 	}
     }
 if (style)
     printf(" style='%s'", style);
 if (ariaLabel)
-    printf(" aria-label=\"%s\"", ariaLabel);
+    // ariaLabel is often a track shortLabel, which a track hub controls, escape it
+    printf(" aria-label=\"%s\"", htmlEncode(ariaLabel));
 printf(">\n");
 for (i=0; i<menuSize; ++i)
     {
     if (sameWord(menu[i], checked))
         selString = " SELECTED";
     else
         selString = "";
 
     char* opt = menu[i];
     printf("<OPTION%s value='%s'>%c%s</OPTION>\n", selString, opt, toupper((unsigned char)opt[0]), opt+1);
     }
 printf("</SELECT>\n");
 }
 
 void cgiMakeDropListClassWithIdStyleAndJavascript(char *name, char *id, char *menu[],
@@ -2584,33 +2586,34 @@
 printf(">\n");
 for (i=0; i<count; ++i)
     {
     if (sameWord(values[i], selected))
         selString = " SELECTED";
     else
         selString = "";
     printf("<OPTION%s value='%s'>%s</OPTION>\n", selString, values[i], text[i]);
     }
 printf("</SELECT>\n");
 }
 
 void cgiMakeHiddenVarWithIdExtra(char *varName, char *id, char *string,char *extra)
 /* Store string in hidden input for next time around. */
 {
-printf("<INPUT TYPE=HIDDEN NAME='%s'", varName);
+// varName can carry a hub-supplied string (a bigBed field name from labelFields), escape
+printf("<INPUT TYPE=HIDDEN NAME='%s'", htmlEncode(varName));
 if (id)
-    printf(" ID='%s'", id);
+    printf(" ID='%s'", htmlEncode(id));
 if (extra)
     printf(" %s",extra);
 printf(" VALUE='%s'>\n", string);
 }
 
 void cgiContinueHiddenVar(char *varName)
 /* Write CGI var back to hidden input for next time around. */
 {
 if (cgiVarExists(varName))
     cgiMakeHiddenVarWithIdExtra(varName, varName, cgiString(varName), NULL);
 }
 
 void cgiChangeVar(char *varName, char *value)
 /* An entry point to change the value of a something passed to us on the URL. */
 {