62132f503d586f5172a397772c6ca6af3e8eccfb braney Sun Sep 6 13:16:05 2026 -0700 docent: four more regression scripts, three of them watched to fail 29 scripts now, 28 of the 36 tickets that can have one. All green against genome-test. The suite's standing weakness is that almost nothing in it was ever seen to fail on a build that still had its bug, so the whole weight sits on assertion tightness. Three of these four do not have that problem. hgwbeta is running v503 and two of these fixes ship in v504, so the broken behavior was still there to be read this morning and each assertion was checked against it: rm38185 empty CGI pair. hgwbeta lands on chr7:155,799,529-155,812,871, hg38's default, because the position= after the && is silently lost; the same pair at the end returns "Mangled CGI input string &". The assertion is the position itself, since losing a variable produces no error to look for. rm38126 hub description filtering. The fixture hub is ours and deliberately malformed. Every structural check flips: on hgwbeta the chosen id, the script element and the form input are all still in the DOM, and on genome-test the id carries the descPage- prefix and the other two are gone. has:/noHas: rather than text:, because a script element's contents are not in innerText on either build -- a noText: there would have passed everywhere and asserted nothing. The two text checks deliberately do not flip: they are what stops the run passing on a page where the description simply failed to load. rm36836 a GenArk assembly and an assembly hub opened by URL. This one was only ever broken on hgwdev, so genome-test is the only server it could have been caught on. It was fixed by reverting #36835, so what the script guards is a second attempt at that work. rm38108 the caller-supplied upload address. No server left to watch it fail on: the fix is in v503_branch so hgwbeta has it, and the RR is still on v502 and so still vulnerable -- deliberately not driven there, since the reproducer's whole effect is to kill the CGI serving it. hgSession shares the fix but answers the crafted GET with the sign-in page, so it is not in the script. New fixture ~braney/docentFixtures/descFilterHub, for rm38126 only. hubCheck reports its script and form on purpose: that reporting is the other half of #38126, and the hub is not to be tidied up. refs #38252 diff --git src/hg/utils/docent/tests/regress/rm38126.docent.yaml src/hg/utils/docent/tests/regress/rm38126.docent.yaml new file mode 100644 index 00000000000..fe655b92ff6 --- /dev/null +++ src/hg/utils/docent/tests/regress/rm38126.docent.yaml @@ -0,0 +1,61 @@ +# #38126 -- the description HTML a hub hands us is printed inside a page of ours, and was +# printed as it arrived. +# +# A hub's track description page is fetched from wherever the hub says and printed into +# hgTrackUi and hgc. Whatever the hub wrote ran in our origin, with our cookies. 646595ff1c1 +# (branch hubSanitize) put htmlSanitize in front of it: the HTML is reduced to an allowlist +# of elements, attributes and style properties. An element that is not on the keep list +# loses its tag but keeps its text, so a pasted document still reads as the article it was +# meant to be, while script, style, form and their kin go away with everything inside them. +# Every id, and every name on an anchor, is renamed with the fixed prefix "descPage-" +# (inc/htmlSanitize.h), so a name the outside HTML chose cannot collide with one our own +# JavaScript looks up. Ships in v504. +# +# THE FIXTURE IS DELIBERATELY MALFORMED. ~braney/docentFixtures/descFilterHub is ours, and +# its descProbe.html carries a script, a form and a div with a chosen id for no reason but +# to be filtered. hubCheck reports two of them, which is the other half of #38126 -- a hub +# author should hear about it from us rather than from a page that comes out wrong: +# +# warning: on the 'descFilterProbe' description page the Browser removed the form +# element and everything inside it +# warning: ... removed the script element and everything inside it +# +# Do not "fix" the fixture. +# +# EVERY STRUCTURAL CHECK BELOW WAS WATCHED TO FAIL. The fix is on master for v504, so on +# 2026-09-06 hgwbeta still printed the description raw, and the same page was read on both: +# +# genome-test hgwbeta +# id="descPage-hubDescProbe" present absent +# id="hubDescProbe" absent present +# id="hubDescProbeScript" absent present +# name="hubDescProbeInput" absent present +# +# The two text checks are the companion half and do NOT flip: they hold on both servers, +# and they are here so the run cannot pass on a page where the description simply failed to +# load. A filter that removed everything would satisfy every noHas: on its own. +# +# has:/noHas: rather than text:, because a <script> element's contents are not in +# innerText on either build. A noText: on the script body would have passed everywhere and +# asserted nothing. This is the case those two checks exist for. +target: genome-test +db: hg38 +position: chr1:10537500-10538000 +reset: true +fast: true +steps: + # uc.1, the first item in the fixture's bigBed, so the row below is evidence the hub + # really loaded rather than evidence that a link exists. + - hub: {url: "https://hgwdev.gi.ucsc.edu/~braney/docentFixtures/descFilterHub/hub.txt", db: hg38, position: chr1:10537500-10538000} + - expect: {rows: [descFilterProbe], noText: "Warning/Error"} + + # The track's own settings page, which is where printTrackHtml puts the description. + - click: 'a[href*="hgTrackUi"][href*="descFilterProbe"]' + + - expect: + text: "This sentence must survive the filter unchanged." + has: "#descPage-hubDescProbe" + + - expect: + text: "Text inside an element that only loses its tag." + noHas: ["#hubDescProbe", "#hubDescProbeScript", 'input[name="hubDescProbeInput"]']