646595ff1c14e1e575a832fc17ec8e238d7ba2e5
Merge parents 92af4b0363b 1258d7f65e7
braney
  Mon Aug 31 14:01:32 2026 -0700
Merge branch 'hubSanitize': filter the description HTML a hub sends us, refs #38126

A track hub, a custom track and an assembly description page all hand us HTML
that we print inside a page of ours.  htmlSanitize reduces that HTML to an
allowlist of elements, attributes and style properties before we print it.  An
element that is not on the keep list loses its tag but keeps its text, so a
whole pasted document still comes out as the article it was meant to be.
Script, style, form and their kin go away with everything inside them.

Every id, and every name on an anchor, is renamed with a fixed prefix, so a
name the outside HTML chose cannot be one our own JavaScript looks up.  A link
to a name on the same page is renamed to match.

hubCheck now names the parts of a description page that the Browser will not
print, so a hub author hears it from us rather than from a page that comes out
wrong.

diff --cc src/lib/makefile
index cd9b3be5fcf,572178b2892..b4970495428
--- src/lib/makefile
+++ src/lib/makefile
@@@ -14,39 -14,40 +14,40 @@@
      dgRange.o diGraph.o dlist.o dnaLoad.o dnaMarkov.o dnaMotif.o dnaseq.o \
      dnautil.o dtdParse.o dyOut.o dystring.o elmTree.o \
      emblParse.o errCatch.o errAbort.o \
      fa.o ffAli.o ffScore.o fieldedTable.o filePath.o fixColor.o flydna.o fof.o \
      font/mgCourier10.o font/mgCourier12.o font/mgCourier14.o font/mgCourier18.o \
      font/mgCourier24.o font/mgCourier34.o font/mgCourier8.o font/mgHelvetica10.o \
      font/mgHelvetica12.o font/mgHelvetica14.o font/mgHelvetica18.o font/mgHelvetica24.o \
      font/mgHelvetica34.o font/mgHelvetica8.o font/mgHelveticaBold10.o font/mgHelveticaBold12.o \
      font/mgHelveticaBold14.o font/mgHelveticaBold18.o font/mgHelveticaBold24.o \
      font/mgHelveticaBold34.o font/mgHelveticaBold8.o font/mgSixhi6.o font/mgSail8.o \
      font/mgTimes10.o font/mgTimes12.o font/mgTimes14.o font/mgTimes18.o \
      font/mgTimes24.o font/mgTimes34.o font/mgTimes8.o font/mgMenlo12.o \
      fq.o freeType.o fuzzyShow.o \
      gapCalc.o gdf.o gemfont.o genomeRangeTree.o \
      gfNet.o gff.o gff3.o gfxPoly.o gifLabel.o \
-     hacTree.o hash.o hex.o hfileUdc.o histogram.o hmmPfamParse.o hmmstats.o htmlColor.o htmlPage.o htmshell.o \
+     hacTree.o hash.o hex.o hfileUdc.o histogram.o hmmPfamParse.o hmmstats.o htmlColor.o htmlPage.o \
+     htmlSanitize.o htmshell.o \
      hmac.o https.o intExp.o intValTree.o internet.o itsa.o iupac.o \
      jointalign.o jpegSize.o jsonParse.o jsonQuery.o jsonWrite.o \
      keys.o knetUdc.o kxTok.o linefile.o lineFileOnBigBed.o localmem.o log.o longTabix.o longToList.o \
      maf.o mafFromAxt.o mafScore.o mailViaPipe.o md5.o \
      matrixMarket.o memalloc.o memgfx.o meta.o metaWig.o mgCircle.o \
      mgPolygon.o mime.o mmHash.o net.o nib.o nibTwo.o nt4.o numObscure.o \
      obscure.o oldGff.o oligoTm.o options.o osunix.o pairHmm.o pairDistance.o \
 -    paraFetch.o peakCluster.o \
 +    paraFetch.o peakCluster.o perfTimer.o \
      phyloTree.o pipeline.o portimpl.o pngwrite.o psGfx.o psPoly.o pscmGfx.o \
      psl.o pslGenoShow.o pslShow.o pslTbl.o pslTransMap.o pthreadDoList.o pthreadWrap.o \
      qa.o quickHeap.o quotedP.o \
      ra.o rainbow.o raToStruct.o rbTree.o rangeTree.o regexHelper.o repMask.o \
      rle.o rnautil.o rqlEval.o rqlParse.o rqlToSql.o rudp.o \
      scoreWindow.o seg.o seqOut.o seqStats.o servBrcMcw.o servCrunx.o \
      servcis.o servcl.o servmsII.o servpws.o shaRes.o slog.o snof.o \
      snofmake.o snofsig.o spaceSaver.o spacedColumn.o spacedSeed.o \
      sparseMatrix.o splatAli.o sqlList.o sqlNum.o sqlReserved.o strex.o subText.o sufa.o sufx.o synQueue.o \
      tabRow.o tagSchema.o tagStorm.o tagToJson.o tagToSql.o textOut.o tokenizer.o trix.o twoBit.o \
      udc.o uuid.o vcf.o vcfBits.o vGfx.o vPng.o verbose.o vMatrix.o \
      wildcmp.o windowsToAscii.o wormdna.o \
      xAli.o xa.o xap.o xenshow.o xmlEscape.o xp.o zlibFace.o curlWrap.o
  
  $(MACHTYPE)/jkweb.a: $(O) $(MACHTYPE)