f759bf663debc22e6015c6c38c22f922bfbdf45b
braney
  Fri Aug 21 10:01:02 2026 -0700
lib, cgilib: sanitize description HTML where it comes in, refs #38126

A track hub's track description, a custom track's documentation, and an
assembly hub's genome description are all written by somebody else and were
stored and printed as they arrived.  Run each through htmlSanitize() at the
point it is read, so that everything downstream sees text we are willing to
print.  Sanitizing on the way in is the only practical place: printTrackHtml()
alone has more than a hundred callers, and hgTrackUi, hui.c, hgGene,
hgGtexTrackSettings and hgTables all print tdb->html directly.

The five places are trackHubAddOneDescription(), customTrack.c where it used
to call jsStripJavascript(), the htmlUrl fetch in customFactory.c,
hgPositionsHelpHtmlCart() and hAssemblyDescription().  In the last two, only
the branch that fetches over the network is touched.  The branch that reads a
local file is left as it is, because those are our own description.html files.

trackHubAddOneDescription() keeps its old shape.  The fetch moves into a
helper so that trackHubDescriptionRemovals() can hand hubCheck the list of
things the filter takes out.

diff --git src/hg/lib/customFactory.c src/hg/lib/customFactory.c
index 6adb7b225c7..d873051a22c 100644
--- src/hg/lib/customFactory.c
+++ src/hg/lib/customFactory.c
@@ -13,30 +13,31 @@
 #include "obscure.h"
 #include "binRange.h"
 #include "pipeline.h"
 #include "cheapcgi.h"
 #include "jksql.h"
 #include "net.h"
 #include "bed.h"
 #include "psl.h"
 #include "gff.h"
 #include "wiggle.h"
 #include "genePred.h"
 #include "trackDb.h"
 #include "hgConfig.h"
 #include "hdb.h"
 #include "hui.h"
+#include "htmlSanitize.h"
 #include "customTrack.h"
 #include "customPp.h"
 #include "customFactory.h"
 #include "trashDir.h"
 #include "jsHelper.h"
 #include "encode/encodePeak.h"
 #include "udc.h"
 #include "bbiFile.h"
 #include "bigWig.h"
 #include "bigBed.h"
 #include "hgBam.h"
 #include "vcf.h"
 #include "vcfUi.h"
 #include "myVariants.h"
 #include "bedDetail.h"
@@ -3909,31 +3910,34 @@
 	int sd = netUrlOpen(val);
 	if (sd >= 0)
 	    {
 	    char *newUrl = NULL;
 	    int newSd = 0;
 	    if (netSkipHttpHeaderLinesHandlingRedirect(sd, val, &newSd, &newUrl))
 		/* redirect can modify the url */
 		{
 		if (newUrl)
 		    {
 		    freeMem(newUrl);
 		    sd = newSd;
 		    }
 		ds = netSlurpFile(sd);
 		close(sd);
-		track->tdb->html = dyStringCannibalize(&ds);
+		char *fetched = dyStringCannibalize(&ds);
+		/* This came in over the network, so keep only what we allow. */
+		track->tdb->html = htmlSanitize(fetched);
+		freeMem(fetched);
 		}
 	    }
 	}
     errCatchEnd(errCatch);
     if (errCatch->gotError)
 	warn("%s", errCatch->message->string);
     errCatchFree(&errCatch);
     }
 
 tdb->url = hashFindVal(hash, "url");
 
 if ((val = hashFindVal(hash, "visibility")) != NULL)
     {
     if (isdigit(val[0]))
 	{