e4c2e97b5eb35b8f9b7b71eb13a4c24e6c1ece22
max
  Mon Sep 14 09:19:02 2026 -0700
hui, hgTrackUi: encode trackDb setting and cart text in HTML attributes, refs #38123

diff --git src/hg/hgTrackUi/hgTrackUi.c src/hg/hgTrackUi/hgTrackUi.c
index 3bce7c78fa0..10e04213782 100644
--- src/hg/hgTrackUi/hgTrackUi.c
+++ src/hg/hgTrackUi/hgTrackUi.c
@@ -2282,57 +2282,57 @@
 
 void oligoMatchUi(struct trackDb *tdb)
 /* UI for oligo match track */
 {
 char *oligo = cartUsualString(cart, oligoMatchVar, oligoMatchDefault);
 char *strand = cartUsualString(cart, oligoMatchStrandVar, oligoMatchStrandDefault);
 puts("<P><B>Short (2-30 base) sequence:</B>");
 jsInline(
 "function packTrack()\n"
 "{\n"
 "var box = jQuery('select[name$=oligoMatch]');\n"
 "if (box.val()=='hide')\n"
 "    box.val('pack');\n"
 "}\n");
 printf("<input name='%s' id='%s' size=\"%d\" value=\"%s\" type=\"TEXT\">",
-    oligoMatchVar, oligoMatchVar, 45, oligo);
+    oligoMatchVar, oligoMatchVar, 45, htmlEncode(oligo));   // cart value, encode it
 puts("<br>Examples: TATAWAAR, AAAAA");
 jsOnEventById("input", oligoMatchVar, "packTrack();");
 
 puts("<P><B>Search strand:</B> ");
 cgiMakeRadioButton(oligoMatchStrandVar, "both", sameString(strand, "both"));
 puts(" Both ");
 cgiMakeRadioButton(oligoMatchStrandVar, "forward", sameString(strand, "forward"));
 puts(" Forward (+) ");
 cgiMakeRadioButton(oligoMatchStrandVar, "reverse", sameString(strand, "reverse"));
 puts(" Reverse (-) ");
 }
 
 static void gcOnFlyUi(struct trackDb *tdb)
 /* UI for GC on the fly track */
 {
 char *winSize = cartUsualString(cart, gcOnFlyWindowSize, gcOnFlyDefaultSize);
 puts("<P><B>GC Percent calculation window size:&nbsp;</B>");
 jsInline(
 "function fullTrack()\n"
 "{\n"
 "var box = jQuery('select[name$=gcOnFly]');\n"
 "if (box.val()=='hide')\n"
 "    box.val('full');\n"
 "}\n");
 printf("<input name='%s' id='%s' size=\"%d\" value=\"%s\" type=\"TEXT\">",
-    gcOnFlyWindowSize, gcOnFlySizeVar, 15, winSize);
+    gcOnFlyWindowSize, gcOnFlySizeVar, 15, htmlEncode(winSize));   // cart value, encode it
 jsOnEventById("input", gcOnFlySizeVar, "fullTrack();");
 puts("<P>UCSC standard window size is 5 bases.  Adjust size as desired.</P>");
 /* Add standard wiggle graph controls (height, scale, graph type, smoothing, etc.) */
 wigCfgUi(cart, tdb, tdb->track, "Graph configuration:", FALSE);
 printf("<hr><h4>Data Access</h4>\n");
 printf("<p>This track is generated <em>on-the-fly</em> by the browser as needed.\n"
  "There is no existing data file for this track.  To obtain the data for this track\n"
  "use the following <a href='https://hgdownload.gi.ucsc.edu/downloads.html#utilities_downloads'\n"
  " target=_blank>kent command line</a> program <b>hgGcPercent</b>:</p>\n");
 
 /* Don't free asmName, it is not allocated */
 char *asmName = hubConnectSkipHubPrefix(database);
 boolean genArk = isGenArk(asmName);
 char twoBitUrl[PATH_LEN];
 if (genArk)