b88e4615c7ce7ea3f0d05c84365509670493840c
braney
  Tue Aug 18 14:49:17 2026 -0700
lib, hgc, hgTracks: small output-encoding cleanups, refs #38123

diff --git src/hg/hgTracks/config.c src/hg/hgTracks/config.c
index 52f5dcdd8bb..407cddd2ae0 100644
--- src/hg/hgTracks/config.c
+++ src/hg/hgTracks/config.c
@@ -342,31 +342,30 @@
     char *indicatorImg;
     boolean isOpen = !isCollapsedGroup(group);
     collapseGroupGoodies(isOpen, FALSE, &indicatorImg,
                             &indicator, &otherState);
     hPrintf("<TR NOWRAP class='nativeToggleBar'>");
     hPrintf("<TH NOWRAP align='left' colspan=3>");
     hPrintf("<table style='width:100%%;'><tr class='noData'><td style='text-align:left;'>");
     hPrintf("\n<A NAME='%sGroup'></A>",group->name);
     hPrintf("<input type=hidden name='%s' id='%s' value=%d>",
             collapseGroupVar(group->name),collapseGroupVar(group->name), (isOpen?0:1));
     char idText[256];
     safef(idText, sizeof idText, "%s_button", group->name);
     hPrintf("<IMG class='toggleButton' "
             "id='%s' src='%s' alt='%s' title='%s this group'>&nbsp;&nbsp;",
             idText, indicatorImg, indicator,isOpen?"Collapse":"Expand");
-    // TODO XSS filter group->name
     jsOnEventByIdF("click", idText, "return vis.toggleForGroup(this,'%s');", group->name);
 
     // a hub group's label is built from the hub's shortLabel and its groups.txt label
     hPrintf("<B>&nbsp;%s</B> ", htmlEncode(group->label));
     hPrintf("&nbsp;&nbsp;&nbsp;");
     hPrintf("</td><td style='text-align:right;'>\n");
     safef(idText, sizeof idText, "%s_hideAllBut", group->name);
     hPrintf("<INPUT TYPE=SUBMIT NAME=\"%s\" id='%s' VALUE=\"%s\" "
             "title='Hide all tracks in this group'>",
 	    configHideAll, idText, "Hide all");
     // TODO XSS filter configGroupTarget
     char jsText[256]; 
     // used several times
     safef(jsText, sizeof jsText, "document.mainForm.%s.value='%s'; %s",
 	    configGroupTarget, group->name, jsSetVerticalPosition("mainForm"));