074ea922bc80e0c46b93fb22b91426770022e4e2
braney
  Tue Aug 18 10:59:40 2026 -0700
lib, cheapcgi: encode some JSON tags and HTML attributes consistently, refs #38123

diff --git src/hg/hgTrackUi/hgTrackUi.c src/hg/hgTrackUi/hgTrackUi.c
index d476e36a32f..4a883081e32 100644
--- src/hg/hgTrackUi/hgTrackUi.c
+++ src/hg/hgTrackUi/hgTrackUi.c
@@ -3872,31 +3872,31 @@
 	if ((trackVersion != NULL) && !isEmpty(trackVersion->version))
 	    {
 	    safef(longLabel, sizeof(longLabel), "%s - Annotation Release %s", tdb->longLabel, trackVersion->version);
 	    }
 	else
 	    safef(longLabel, sizeof(longLabel), "%s", tdb->longLabel);
 	}
     printf("<B style='font-size:200%%;'>%s%s</B>\n", longLabel, tdbIsSuper(tdb) ? " Tracks" : "");
     }
 else
     {
     if (trackDbSetting(tdb, "wgEncode"))
         printf("<A HREF='/ENCODE/index.html'><IMG style='vertical-align:middle;' "
                "width=100 src='/images/ENCODE_scaleup_logo.png'><A>");
     // set large title font size, but less so for long labels to minimize wrap
-    // longLabel can come from a track hub (user-supplied), escape before echoing (XSS)
+    // longLabel can come from a track hub (user-supplied), escape before echoing
     printf("<B style='font-size:%d%%;'>%s%s</B>\n", strlen(tdb->longLabel) > 30 ? 133 : 200,
                 htmlEncode(tdb->longLabel), tdbIsSuper(tdb) ? " tracks" : "");
 
     // Add a description link if there is one.  Only for faceted composites for now.
     if (isNotEmpty(tdb->html) && (tdbIsComposite(tdb) && sameOk(trackDbLocalSetting(tdb, "compositeTrack"), "faceted")))
         {
         char *downArrow = "&dArr;";
         enum browserType browser = cgiBrowser();
         if (browser == btIE || browser == btFF)
             downArrow = "&darr;";
         printf("&nbsp;&nbsp;(<A HREF='#TRACK_HTML' TITLE='Jump to description section of page'>"
                "Description%s</A>)", downArrow);
         }
 
     }