a88795fb31a7f51bef649eb6eedb626b771a8893
braney
  Sat Sep 5 08:20:34 2026 -0700
urlCommandCatalog: the SNP "Set defaults" button persists in the session.

Fallout from walking the cart baseline: snp125Defaults_coloring is read with
cgiOptionalString at hgTrackUi.c:563, deliberately so, because only a click
in this request should clear the SNP colour variables.  Nothing then keeps
the click out of the session.  It is in one saved session and four live
carts.

Harmless in itself, since the reset only fires when the value arrives on the
request and a stored copy does nothing, but a one-shot command that persists
is the same defect whatever its blast radius, so it gets a row with
leaks=True.

Two things the row records because they are not obvious from the name.  It
looks track-scoped and is not: the prefix is the fixed string
snp125Defaults.  And listing it in hgTrackUi's excludeVars would not help as
that array stands, because hgTrackUi.c:4718 has a stray NULL in the middle
of it, so "ajax" and anything added after it are unreachable.  That is
latent rather than live: hgTrackUi reads ajax from the cart and removes it
explicitly, and no cart in the three tables holds it.  I sorted through
every excludeVars[] in the tree and it is the only one with a NULL before
the end.  Not fixed here.

refs #37923 #37979

diff --git src/hg/utils/urlCommandCatalog/urlCommandCatalog.py src/hg/utils/urlCommandCatalog/urlCommandCatalog.py
index e5536819290..783d78a5700 100755
--- src/hg/utils/urlCommandCatalog/urlCommandCatalog.py
+++ src/hg/utils/urlCommandCatalog/urlCommandCatalog.py
@@ -859,30 +859,49 @@
         ],
     },
     "hgTrackUi": {
         "what": "The track configuration page.",
         "cmds": [
             c("g", "action", "hg/hgTrackUi/hgTrackUi.c:4643", value="<track>",
               public=True, verified=True,
               note="Which track's settings page to show."),
             c("track", "action", "hg/hgTrackUi/hgTrackUi.c:4643",
               value="<track>", verified=True, note="Alternate spelling of g."),
             c("fileUrl", "action", "hg/hgTrackUi/hgTrackUi.c:4643",
               value="<url>", verified=True,
               note="Configure a track straight from a data file URL."),
             c("sourceDb", "action", "hg/hgTrackUi/hgTrackUi.c:4643",
               value="<db>", verified=True, note="Assembly the track came from."),
+            c("snp125Defaults_coloring", "action",
+              "hg/hgTrackUi/hgTrackUi.c:563", value="Set+defaults",
+              verified=True, leaks=True,
+              note="The \"Set defaults\" button under the SNP colouring "
+                   "section.  snp125ResetColorVarsIfNecessary reads it with "
+                   "cgiOptionalString, not from the cart, and says in a "
+                   "comment that this is deliberate: only a click in this "
+                   "request should clear the colour variables.  But nothing "
+                   "then keeps the click out of the session.  It is not in "
+                   "hgTrackUi's excludeVars, and would be unreachable there "
+                   "even if it were listed, because that array has a stray "
+                   "NULL in the middle (hgTrackUi.c:4718) which ends it "
+                   "early.  Found in one saved session and four live carts, "
+                   "which is harmless in itself: the reset only fires when "
+                   "the value arrives on the request, so a stored copy does "
+                   "nothing.  Cataloged because a one-shot command that "
+                   "persists is the same defect whatever its blast radius.  "
+                   "The name looks track-scoped and is not: the prefix is "
+                   "the fixed string snp125Defaults."),
         ],
     },
     "hgCustom": {
         "what": "The custom track management page.",
         "cmds": [
             c("hgct_doRemoveCustomTrack", "action",
               "hg/inc/customTrack.h:77", verified=True,
               note="Delete the selected custom track."),
             c("hgct_table", "action", "hg/inc/customTrack.h:78",
               value="<table>", verified=True, note="Which custom track."),
             c("hgct_updatedTable", "action", "hg/inc/customTrack.h:79",
               value="<table>", verified=True, leaks=True),
             c("op", "action", "hg/hgCustom/hgCustom.c", value="<verb>",
               verified=True, leaks=True, note="Which operation the page should perform."),
             c("SubmitFile", "action", "hg/hgCustom/hgCustom.c:92",