cb99f0b11bdeee5dfa76064d38b6410da0f4a709
max
Thu Sep 10 00:55:21 2026 -0700
Centralize CGI Content-Type printing in one cgiPrintContentType() helper
Around 90 places across the tree hand-rolled the CGI response header, each
with its own spelling: "Content-Type:" or "Content-type:", \n or \r\n, and
the terminating blank line written as part of the same string, as a separate
puts("\n") (which emits two newlines, so a stray blank line led the body) or
as printf("\r\n\r\n") (two blank lines). A handful forgot the terminator
entirely and relied on a following header to supply it.
cgiPrintContentType() in lib/cheapcgi.c now writes the Content-Type line and
the blank line that ends the header. Header lines are not ordered, so the
callers that also send Status, Set-Cookie, Content-Disposition, Content-Length
or X-Sendfile write those first and call this last to close the header; that
keeps it to a single helper rather than a print-the-line / end-the-header pair
that a caller can half-use. cart.c's existing httpHeaders list already worked
this way.
Only the CGI response path is touched. The dyStringPrintf("Content-type: ...")
calls that build outgoing HTTP *requests* (genomeSpace, oauthLogin, eapMetaSync,
edwWebAuthLogin, ga4ghToBed) are unrelated and left alone.
Also fills out the apiKey error message in botDelay.c to say where to create a
key and that keys are server-specific.
No behavior change on the wire beyond dropping those stray blank lines and
adding the missing newline after Retry-After.
diff --git src/hg/hgSearch/hgSearch.c src/hg/hgSearch/hgSearch.c
index d781270cd66..93b55ae37da 100644
--- src/hg/hgSearch/hgSearch.c
+++ src/hg/hgSearch/hgSearch.c
@@ -594,31 +594,31 @@
struct trackDb *track = NULL;
if (!sameString(trackName, "chromInfo"))
{
track = tdbForTrack(db, trackName, &hgFindTdbList);
if (!track && startsWith("all_", trackName))
track = tdbForTrack(db, trackName+strlen("all_"), &hgFindTdbList);
if (!track)
errAbort("no track for table \"%s\" found via a findSpec", trackName);
}
if (track)
{
trackName = cloneString(track->track);
}
trackHubFixName(trackName);
cspWriteResponseHeader();
- puts("Content-type:text/html\n");
+ cgiPrintContentType("text/html");
puts("\n\n");
printf("\n");
printf(" can break out (XSS).
char *jsDb = jsonStringEscape(db);
char *jsSearch = jsonStringEscape(userSearch);
printf("addRecentSearch(\"%s\", \"%s\", {\"label\": \"%s\", \"value\": \"%s\", \"id\": \"%s\"});\n",
jsDb, jsSearch, jsSearch, jsSearch, newPosBuf);
printf("window.location.href=\"../cgi-bin/hgTracks?");
// db here is a URL query parameter, so cgi-encode it rather than reuse the JS-escaped jsDb
char *urlDb = cgiEncode(db);