983b7eff4b1c516c9cb7bb56cc1399216a127d51
max
  Wed Aug 19 04:02:39 2026 -0700
address v503 preview1 code review (#38141): escaping and oauth fixes

Fixes the six items Brian raised reviewing the XSS sweep (#38057) and the
BLAT-results group work (#38086):

- hgGenome/configure.c, hgPal.c: drop htmlEncode() on cartWebStart title args;
cartWebStart already escapes the title, so this was double-escaping.
- hgSession.c doReSaveSession: htmlEncode the user name and pass the encoded
name to getSessionLink (same fix already applied at line 1544).
- hgUserSuggestion.c printInvalidForm: cgiEncode the five cart values echoed
into the mailto: href (reachable on the robot/captcha path).
- hgSearch.c: cgiEncode db for the hgTracks URL query parameter instead of
reusing the JSON-escaped copy meant for the JS string literal.
- hgLogin.c oauthReturn: clone oauth_provider before cartRemove frees it, so
the later oauthFetchIdentity call is not a read-after-free.
- customFactory.c checkGroup: only accept group=blat when blatResultsGroup is
on, matching hgTracks; otherwise the group is never created and the track
would orphan into 'other'.

refs #38141, refs #38057, refs #38086

diff --git src/hg/hgGenome/configure.c src/hg/hgGenome/configure.c
index ef968519047..a2375e73644 100644
--- src/hg/hgGenome/configure.c
+++ src/hg/hgGenome/configure.c
@@ -121,31 +121,31 @@
 /* Put up configuration for one graph. */
 {
 /* Figure out which graph we're configuring. */
 char *graphName = cartString(cart, "g");
 struct genoGraph *gg = hashFindVal(ggHash, graphName);
 if (gg == NULL)
     {
     /* Warn/return rather than abort if have problems, so that 
      * cartRemovePrefix(hggDo) is executed to keep us from error
      * loop forever... */
     warn("Graph %s not found", graphName);
     return;
     }
 
 /* Put up web page with controls */
-cartWebStart(cart, database, "Configure %s", htmlEncode(gg->shortLabel));
+cartWebStart(cart, database, "Configure %s", gg->shortLabel); // cartWebStart escapes the title itself
 hPrintf("<FORM ACTION=\"../cgi-bin/hgGenome\" METHOD=GET>\n");
 cartSaveSession(cart);
 cgiMakeHiddenVar(hggConfigure, "on");
 struct chromGraphSettings *cgs = gg->settings;
 char varName[chromGraphVarNameMaxSize];
 chromGraphVarName(gg->name, "minVal", varName);
 hPrintf("display min value: ");
 cartMakeIntVar(cart, varName, cgs->minVal, 5);
 chromGraphVarName(gg->name, "maxVal", varName);
 hPrintf(" max value: ");
 cartMakeIntVar(cart, varName, cgs->maxVal, 5);
 hPrintf("<BR>\n");
 hPrintf("draw connecting lines between markers separated by up to ");
 chromGraphVarName(gg->name, "maxGapToFill", varName);
 cartMakeIntVar(cart, varName, cgs->maxGapToFill, 8);