f247b79b61ca172b3146284594b97c848db4c8bf
braney
  Wed Sep 2 11:20:43 2026 -0700
hgSession, hgGenome: tighten handling of an uploaded file's name, refs #38172

Both CGIs print the name that arrives with an upload straight into the page.
hgSession prints it in four of its load messages, so encode it once where it
is read; the sibling URL message three lines above already did the same for
the URL.  hgGenome puts it in a quoted attribute, which wants
attributeEncode.

Raised in the v503 Preview II code review.

diff --git src/hg/hgGenome/upload.c src/hg/hgGenome/upload.c
index 879da8ec46a..c97c97f8bf9 100644
--- src/hg/hgGenome/upload.c
+++ src/hg/hgGenome/upload.c
@@ -8,30 +8,31 @@
 #include "hash.h"
 #include "ra.h"
 #include "portable.h"
 #include "cheapcgi.h"
 #include "localmem.h"
 #include "cart.h"
 #include "web.h"
 #include "chromInfo.h"
 #include "chromGraph.h"
 #include "chromGraphFactory.h"
 #include "errCatch.h"
 #include "hPrint.h"
 #include "customTrack.h"
 #include "hgGenome.h"
 #include "trashDir.h"
+#include "htmshell.h"
 
 
 static char *markerNames[] = {
     cgfMarkerGuess,
     cgfMarkerGenomic,
     cgfMarkerSts,
     cgfMarkerSnp,
     // cgfMarkerAffy100,
     cgfMarkerAffy500,
     cgfMarkerAffy6,
     cgfMarkerAffy6SV,
 
     cgfMarkerHumanHap300,
     cgfMarkerHumanHap550,
     cgfMarkerHumanHap650,
@@ -86,32 +87,33 @@
 hPrintf("<BR>\n");
 
 hPrintf("display min value: ");
 cartMakeTextVar(cart, hggMinVal, "", 5);
 hPrintf(" max value: ");
 cartMakeTextVar(cart, hggMaxVal, "", 5);
 hPrintf("<BR>\n");
 
 hPrintf("label values: ");
 cartMakeTextVar(cart, hggLabelVals, "", 32);
 hPrintf("<BR>\n");
 hPrintf("draw connecting lines between markers separated by up to ");
 cartMakeIntVar(cart, hggMaxGapToFill, 25000000, 8);
 hPrintf(" bases.<BR>");
 hPrintf("<BR>\n");
+/* oldFileName arrives with the upload and lands inside a quoted attribute. */
 hPrintf("file name: <INPUT TYPE=FILE NAME=\"%s\" VALUE=\"%s\">", hggUploadFile,
-	oldFileName);
+	attributeEncode(oldFileName));
 hPrintf("<BR>\n");
 hPrintf("&nbsp;or<BR>\n");
 hPrintf("Paste URLs or data:<br>");
 cgiMakeTextArea(hggUploadUrl, "", 7, 73);
 hPrintf("<BR>\n");
 hPrintf("<BR>\n");
 cgiMakeButton(hggSubmitUpload, "submit");
 hPrintf("</FORM>\n");
 hPrintf("<i>Note: If you are uploading more than one data set please give them ");
 hPrintf("different names.  Only the most recent data set of a given name is ");
 hPrintf("kept.  Otherwise data sets will be kept for at least 48 hours from ");
 hPrintf("last use.  After that time you may have to upload them again.</i>");
 
 /* Put up section that describes file formats. */
 webNewSection("Upload file formats");