7a185fecc55ea44b360f04d250e64bcbaaf4d53e hiram Wed Sep 2 13:45:33 2026 -0700 remove references and functions related to the "debug" argument, becomes a harmless no-operation and eliminated potential security loop-holes no redmine diff --git src/hg/hubApi/hubApi.c src/hg/hubApi/hubApi.c index 024bfec48a7..3b55202de6e 100644 --- src/hg/hubApi/hubApi.c +++ src/hg/hubApi/hubApi.c @@ -21,31 +21,32 @@ | registrationTime | varchar(255) | NO | | NULL | | | dbCount | int(10) unsigned | NO | | NULL | | | dbList | blob | YES | | NULL | | | descriptionUrl | longblob | YES | | NULL | | +------------------+------------------+------+-----+---------+-------+ */ /* Global Variables for all modules */ static int maxItemLimit = 1000000; /* maximum of 1,000,000 items returned */ int maxItemsOutput = 1000000; /* can be set in URL maxItemsOutput=N */ boolean reachedMaxItems = FALSE; /* during getData, signal to return */ long long itemsReturned = 0; /* for getData functions, number of items returned */ /* for debugging purpose, current bot delay value */ int botDelay = 0; -boolean debug = FALSE; /* can be set in URL debug=1, to turn off: debug=0 */ +/* debug options removed/disabled 2026-09-02 */ +/* boolean debug = FALSE; can be set in URL debug=1, to turn off: debug=0 */ #define delayFraction 0.03 /* default is to list all trackDb entries, composite containers too. * This option will limit to only the actual track entries with data */ boolean trackLeavesOnly = FALSE; /* set by CGI parameter 'trackLeavesOnly' */ /* this selects output type 'arrays', where the default type is: objects */ boolean jsonOutputArrays = FALSE; /* set by CGI parameter 'jsonOutputArrays' */ boolean measureTiming = FALSE; /* set by CGI parameters */ /* downloadUrl for use in error exits when reachedMaxItems */ struct dyString *downloadUrl = NULL; /* valid argument listings to verify extraneous arguments */ @@ -263,32 +264,30 @@ } boolean superChild = tdbIsSuperTrackChild(tdb); char *genome = NULL; if (hub) genome = hub->genomeList->name; // tdb->track (and tdb->parent->track) carry the hub__ decoration; // display and outgoing URLs should show/use the name as it actually // appears in trackDb.txt. protectedTrack() below still needs the // decorated tdb->track, untouched, to recognize a hub track. char *trackName = trackHubSkipHubName(tdb->track); char *parentName = tdb->parent ? trackHubSkipHubName(tdb->parent->track) : NULL; struct dyString *extraDyFlags = dyStringNew(128); -if (debug) - dyStringAppend(extraDyFlags, ";debug=1"); if (jsonOutputArrays) dyStringAppend(extraDyFlags, ";jsonOutputArrays=1"); char *extraFlags = dyStringCannibalize(&extraDyFlags); if (protectedTrack(db, tdb, tdb->track)) hPrintf("
  • %s : %s <protected data>
    • \n", trackName, tdb->type); else if (db) { if (hub) { char urlReference[2048]; safef(urlReference, sizeof(urlReference), " (sample data)%s\n", urlPrefix, hub->url, genome, trackName, extraFlags, errorPrint); if (tdb->parent) hPrintf("
  • %s: %s subtrack of parent: %s%s
    • \n", trackName, tdb->type, parentName, urlReference); @@ -314,32 +313,30 @@ safef(urlReference, sizeof(urlReference), " (sample data)%s\n", urlPrefix, hub->url, genome, trackName, extraFlags, errorPrint); if (tdb->parent) hPrintf("
  • %s: %s subtrack of parent: %s%s
    • \n", trackName, tdb->type, parentName, urlReference); else hPrintf("
  • %s: %s%s
    • \n", trackName, tdb->type, urlReference); } else hPrintf("
  • %s : %s not db hub track ?
    • \n", trackName, tdb->type); } static void hubSampleUrl(struct trackHub *hub, char *db, struct trackDb *tdb, long chromCount, long itemCount, char *genome, char *errorString) { struct dyString *extraDyFlags = dyStringNew(128); -if (debug) - dyStringAppend(extraDyFlags, ";debug=1"); if (jsonOutputArrays) dyStringAppend(extraDyFlags, ";jsonOutputArrays=1"); char *extraFlags = dyStringCannibalize(&extraDyFlags); char errorPrint[2048]; errorPrint[0] = 0; if (isNotEmpty(errorString)) { safef(errorPrint, sizeof(errorPrint), " : ERROR: %s", errorString); } char countsMessage[512]; countsMessage[0] = 0; if (chromCount > 0 || itemCount > 0) @@ -512,35 +509,30 @@ { retVal = 1; dyStringPrintf(errors, "%s", errCatch->message->string); } errCatchFree(&errCatch); return retVal; } /* static int bbiBriefMeasure() */ static void hubSubTracks(struct trackHub *hub, char *db, struct trackDb *tdb, struct hash *countTracks, long chromCount, long itemCount, char *chromName, unsigned chromSize, char *genome, char *errorString) /* tdb has subtracks, show only subTracks, no details, this is RECURSIVE */ { hPrintf("
    • \n"); } /* hubSubTracks() */ static void showSubTracks(struct trackHub *hub, char *db, struct trackDb *tdb, struct hash *countTracks, char *chromName, unsigned chromSize, char *errorString) /* tdb has subtracks, show only subTracks, no details */ { hPrintf("
    • \n"); } static void hubCountOneTdb(struct trackHub *hub, char *db, struct trackDb *tdb, char *bigDataIndex, struct hash *countTracks, char *chromName, unsigned chromSize, char *genome) { char *bigDataUrl = trackDbSetting(tdb, "bigDataUrl"); @@ -1129,39 +1114,30 @@ if (isEmpty(httpHost)) urlPrefix = ""; else { if (! startsWith("hgwdev-api", httpHost)) { if (startsWith("hgwdev",httpHost) || startsWith("genome-test", httpHost)) { urlPrefix = "../cgi-bin/hubApi"; } } } } -static void showCartDump() -/* for information purposes only during development, will become obsolete */ -{ -hPrintf("

    cart dump

    "); -hPrintf("
    \n");
-cartDump(cart);
-hPrintf("
    \n"); -} - static void sendJsonHogMessage(char *hogHost) { apiErrAbort(err429, err429Msg, "Your host, %s, has been sending too many requests lately and is " "unfairly loading our site, impacting performance for other users. " "Please contact genome-www@soe.ucsc.edu to ask that your site " "be reenabled. Also, please consider downloading sequence and/or " "annotations in bulk -- see http://genome.ucsc.edu/downloads.html.", hogHost); } static void sendHogMessage(char *hogHost) { puts("X-Content-Type-Options: nosniff"); cspWriteResponseHeader(); puts("Content-Type:text/html"); @@ -1305,34 +1281,30 @@ hCheckBox("jsonOutputArrays", jsonOutputArrays); hWrites(" more array data than objects (default: mostly object output)"); hWrites("\n"); /* go button at the bottom of the table */ hWrites(" "); hButton("sourceSelected", "go"); hWrites("press 'go' after selections made\n"); hPrintf("\n"); hPrintf("(example JSON list output: Public hubs, and UCSC database genomes)\n"); hPrintf("\n"); hPrintf("\n"); - -/* how does debug carry forward ? */ -// if (debug) -// cgiMakeHiddenVar("debug", "1"); } static void apiRequest(char *pathInfo) { hPrintDisable(); /*expect no more than MAX_PATH_INFO number of words*/ char *words[MAX_PATH_INFO]; /* can immediately verify valid parameters right here right now */ char *start = cgiOptionalString("start"); char *end = cgiOptionalString("end"); char *db = cgiOptionalString("genome"); char *hubUrl = cgiOptionalString("hubUrl"); struct dyString *errorMsg = dyStringNew(128); // first check for curated hubs @@ -1467,128 +1439,74 @@ char *pathInfo = getenv("PATH_INFO"); /* nothing on incoming path, then display the WEB page instead */ if (sameOk("/",pathInfo)) pathInfo = NULL; (void) hubPublicDbLoadAll(); webStartJWest(cart, database, "Genome Browser API"); // webStartGbNoBanner(cart, database, "UCSC JSON API interface"); // webStartGbOptionalBanner(cart, database, "UCSC JSON API interface", TRUE, FALSE); hPrintf("
    \n"); /* these style mentions need to go into custom css file */ hPrintf("
    \n"); -if (debug) - { - hPrintf("
      \n"); - hPrintf("
    • hgBotDelay: %d
      • \n", botDelay); - char *envVar = getenv("BROWSER_HOST"); - hPrintf("
    • BROWSER_HOST:%s
      • \n", envVar); - envVar = getenv("CONTEXT_DOCUMENT_ROOT"); - hPrintf("
    • CONTEXT_DOCUMENT_ROOT:%s
      • \n", envVar); - envVar = getenv("CONTEXT_PREFIX"); - hPrintf("
    • CONTEXT_PREFIX:%s
      • \n", envVar); - envVar = getenv("DOCUMENT_ROOT"); - hPrintf("
    • DOCUMENT_ROOT:%s
      • \n", envVar); - envVar = getenv("HTTP_HOST"); - hPrintf("
    • HTTP_HOST:%s
      • \n", envVar); - envVar = getenv("REQUEST_URI"); - hPrintf("
    • REQUEST_URI:%s
      • \n", envVar); - envVar = getenv("SCRIPT_FILENAME"); - hPrintf("
    • SCRIPT_FILENAME:%s
      • \n", envVar); - envVar = getenv("SCRIPT_NAME"); - hPrintf("
    • SCRIPT_NAME:%s
      • \n", envVar); - envVar = getenv("SCRIPT_URI"); - hPrintf("
    • SCRIPT_URI:%s
      • \n", envVar); - envVar = getenv("SCRIPT_URL"); - hPrintf("
    • SCRIPT_URL:%s
      • \n", envVar); - envVar = getenv("SERVER_NAME"); - hPrintf("
    • SERVER_NAME:%s
      • \n", envVar); - envVar = getenv("PATH_INFO"); - if (isNotEmpty(envVar)) - hPrintf("
    • PATH_INFO:'%s'
      • \n", envVar); - else - hPrintf("
    • PATH_INFO:<empty>
      • \n"); - hPrintf("
    \n"); - } - char *otherHubUrl = cartUsualString(cart, "urlHub", ""); char *hubDropDown = cartUsualString(cart, "publicHubs", defaultHub); char *urlDropDown = urlFromShortLabel(hubDropDown); char *ucscDb = cartUsualString(cart, "ucscGenome", defaultDb); char *selectRadio = cartUsualString(cart, RADIO_GROUP, RADIO_PUBHUB); char *urlInput = urlDropDown; /* assume public hub */ -if (debug) - { - hPrintf("
      \n"); - hPrintf("
    • otherHubUrl: '%s'
      • \n", otherHubUrl); - hPrintf("
    • hubDropDown: '%s'
      • \n", hubDropDown); - hPrintf("
    • urlDropDown: '%s'
      • \n", urlDropDown); - hPrintf("
    • ucscDb: '%s'
      • \n", ucscDb); - hPrintf("
    • urlInput: '%s'
      • \n", urlInput); - hPrintf("
    • trackLeavesOnly: '%s'
      • \n", trackLeavesOnly ? "TRUE" : "FALSE"); - hPrintf("
    • jsonOutputArrays: '%s'
      • \n", jsonOutputArrays ? "TRUE" : "FALSE"); - hPrintf("
    \n"); - } if (isEmpty(otherHubUrl)) otherHubUrl = urlInput; if (sameWord(RADIO_OTHERHUB, selectRadio)) /* requested other hub URL */ urlInput = otherHubUrl; long lastTime = clock1000(); struct trackHub *hub = errCatchTrackHubOpen(urlInput); if (measureTiming) { long thisTime = clock1000(); hPrintf("hub open time: %ld millis
    \n", thisTime - lastTime); } hPrintf("

    Documentation: API definitions/help, and Track definition document for definitions of track settings.

    \n"); -if (debug) - showCartDump(); - hPrintf("

    Explore hub or database assemblies and tracks (v%s)

    \n", SRC_VERSION); selectionForm(); /* these style mentions need to go into custom css file */ hPrintf("
    \n"); if (sameWord(RADIO_UCSCDB, selectRadio)) /* requested UCSC db track list */ { tracksForUcscDb(ucscDb); } else { hPrintf("

    %s url: %s

    \n", sameWord(RADIO_PUBHUB,selectRadio) ? "Public hub" : "Other hub", urlInput); hPrintf("
      \n"); hubInfo("hub name", hub->name); hubInfo("short label", hub->shortLabel); hubInfo("long label", hub->longLabel); hubInfo("genomes file", hub->genomesFile); hubInfo("default db", hub->defaultDb); hubInfo("description url", hub->descriptionUrl); hubInfo("email", hub->email); - if (debug) - { - hubInfo("version", hub->version); /* UCSC internal info */ - hubInfo("level", hub->level); /* UCSC internal info */ - } hPrintf("
    \n"); genomeList(hub); } if (timedOut) hPrintf("

    Reached time out %ld seconds

    ", timeOutSeconds); if (measureTiming) hPrintf("Overall total time: %ld millis
    \n", clock1000() - enteredMainTime); hPrintf("
    \n"); hPrintf("
    \n"); hPrintf("
    \n"); webIncludeFile("inc/jWestFooter.html"); @@ -1625,34 +1543,30 @@ else apiErrAbort(err400, err400Msg, "unrecognized 'trackLeavesOnly=%s' argument, can only be =1 or =0", trackLeaves); } char *jsonArray = cgiOptionalString("jsonOutputArrays"); if (isNotEmpty(jsonArray)) { if (SETTING_IS_ON(jsonArray)) jsonOutputArrays = TRUE; else if (sameString("0", jsonArray)) jsonOutputArrays = FALSE; else apiErrAbort(err400, err400Msg, "unrecognized 'jsonOutputArrays=%s' argument, can only be =1 or =0", jsonArray); } -int maybeDebug = cgiOptionalInt("debug", 0); -if (1 == maybeDebug) - debug = TRUE; - char *measTime = cgiOptionalString("measureTiming"); if (isNotEmpty(measTime) && sameWord("1", measTime)) measureTiming = TRUE; char *maxOut = cgiOptionalString("maxItemsOutput"); if (isNotEmpty(maxOut)) { long long n = -2; struct errCatch *errCatch = errCatchNew(); if (errCatchStart(errCatch)) { n = sqlLongLong(maxOut); } errCatchEnd(errCatch); if (errCatch->gotError) apiErrAbort(err400, err400Msg, "can not recognize maxItemsOutput '%s' as a number", maxOut);