@stats-organization/github-readme-stats-core 2.1.3 → 2.1.5

package/build/api/gist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gist.d.ts","sourceRoot":"","sources":["../../src/api/gist.js"],"names":[],"mappings":"AAae;;;;;;;;;;;;;;;;GAqFd"}
+{"version":3,"file":"gist.d.ts","sourceRoot":"","sources":["../../src/api/gist.js"],"names":[],"mappings":"AAYe;;;;;;;;;;;;;;;;GAwHd"}

package/build/api/gist.js

@@ -1,5 +1,5 @@
-// @ts-check
 import { renderGistCard } from "../cards/gist.js";
+import { findInvalidColor } from "../common/color.js";
 import { MissingParamError, retrieveSecondaryMessage, } from "../common/error.js";
 import { parseBoolean } from "../common/ops.js";
 import { renderError } from "../common/render.js";
@@ -7,6 +7,22 @@ import { fetchGist } from "../fetchers/gist.js";
 import { isLocaleAvailable } from "../translations.js";
 // @ts-ignore
 export default async ({ id, title_color, icon_color, text_color, bg_color, theme, locale, border_radius, border_color, show_owner, browser_rendering, hide_border, }, pat = null) => {
+    const invalidColorInput = findInvalidColor({
+        title_color,
+        icon_color,
+        text_color,
+        bg_color,
+        border_color,
+    });
+    if (invalidColorInput) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+            }),
+        };
+    }
     if (locale && !isLocaleAvailable(locale)) {
         return {
             status: "error - permanent",
@@ -23,6 +39,23 @@ export default async ({ id, title_color, icon_color, text_color, bg_color, theme
             }),
         };
     }
+    const safePattern = /^[-\w/.,]+$/;
+    if (id && !safePattern.test(id)) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: "Gist ID contains unsafe characters",
+                renderOptions: {
+                    title_color,
+                    text_color,
+                    bg_color,
+                    border_color,
+                    theme,
+                },
+            }),
+        };
+    }
     try {
         const gistData = await fetchGist(id, pat);
         return {

package/build/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.js"],"names":[],"mappings":"AAae;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2Kd"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.js"],"names":[],"mappings":"AAYe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6Ld"}

package/build/api/index.js

@@ -1,5 +1,5 @@
-// @ts-check
 import { renderStatsCard } from "../cards/stats.js";
+import { findInvalidColor } from "../common/color.js";
 import { MissingParamError, retrieveSecondaryMessage, } from "../common/error.js";
 import { parseArray, parseBoolean } from "../common/ops.js";
 import { renderError } from "../common/render.js";
@@ -7,6 +7,23 @@ import { fetchStats } from "../fetchers/stats.js";
 import { isLocaleAvailable } from "../translations.js";
 // @ts-ignore
 export default async ({ username, repo, owner, hide, hide_title, hide_border, card_width, hide_rank, show_icons, include_all_commits, commits_year, line_height, title_color, ring_color, icon_color, text_color, text_bold, bg_color, theme, exclude_repo, custom_title, locale, disable_animations, border_radius, number_format, role, number_precision, border_color, rank_icon, show, }, pat = null) => {
+    const invalidColorInput = findInvalidColor({
+        title_color,
+        ring_color,
+        icon_color,
+        text_color,
+        bg_color,
+        border_color,
+    });
+    if (invalidColorInput) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+            }),
+        };
+    }
     if (locale && !isLocaleAvailable(locale)) {
         return {
             status: "error - permanent",

package/build/api/pin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/api/pin.js"],"names":[],"mappings":"AAae;;;;;;;;;;;;;;;;;;;;;;;;GAoId"}
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/api/pin.js"],"names":[],"mappings":"AAYe;;;;;;;;;;;;;;;;;;;;;;;;GAqJd"}

package/build/api/pin.js

@@ -1,5 +1,5 @@
-// @ts-check
 import { renderRepoCard } from "../cards/repo.js";
+import { findInvalidColor } from "../common/color.js";
 import { MissingParamError, retrieveSecondaryMessage, } from "../common/error.js";
 import { parseArray, parseBoolean } from "../common/ops.js";
 import { renderError } from "../common/render.js";
@@ -7,6 +7,22 @@ import { fetchRepo } from "../fetchers/repo.js";
 import { isLocaleAvailable } from "../translations.js";
 // @ts-ignore
 export default async ({ username, repo, hide_border, title_color, icon_color, text_color, bg_color, card_width, theme, show_owner, browser_rendering, show, show_icons, number_format, text_bold, line_height, locale, border_radius, border_color, description_lines_count, }, pat = null) => {
+    const invalidColorInput = findInvalidColor({
+        title_color,
+        icon_color,
+        text_color,
+        bg_color,
+        border_color,
+    });
+    if (invalidColorInput) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+            }),
+        };
+    }
     if (locale && !isLocaleAvailable(locale)) {
         return {
             status: "error - permanent",

package/build/api/top-langs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"top-langs.d.ts","sourceRoot":"","sources":["../../src/api/top-langs.js"],"names":[],"mappings":"AAae;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0Jd"}
+{"version":3,"file":"top-langs.d.ts","sourceRoot":"","sources":["../../src/api/top-langs.js"],"names":[],"mappings":"AAYe;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2Ld"}

package/build/api/top-langs.js

@@ -1,5 +1,5 @@
-// @ts-check
 import { renderTopLanguages } from "../cards/top-languages.js";
+import { findInvalidColor } from "../common/color.js";
 import { MissingParamError, retrieveSecondaryMessage, } from "../common/error.js";
 import { parseArray, parseBoolean } from "../common/ops.js";
 import { renderError } from "../common/render.js";
@@ -7,6 +7,22 @@ import { fetchTopLanguages } from "../fetchers/top-languages.js";
 import { isLocaleAvailable } from "../translations.js";
 // @ts-ignore
 export default async ({ username, hide, hide_title, hide_border, card_width, title_color, text_color, bg_color, prog_bar_bg_color, theme, layout, langs_count, exclude_repo, size_weight, count_weight, custom_title, locale, border_radius, border_color, role, disable_animations, hide_progress, hide_values, stats_format, }, pat = null) => {
+    const invalidColorInput = findInvalidColor({
+        title_color,
+        text_color,
+        bg_color,
+        prog_bar_bg_color,
+        border_color,
+    });
+    if (invalidColorInput) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+            }),
+        };
+    }
     if (locale && !isLocaleAvailable(locale)) {
         return {
             status: "error - permanent",
@@ -23,9 +39,25 @@ export default async ({ username, hide, hide_title, hide_border, card_width, tit
             }),
         };
     }
+    const safePattern = /^[-\w/.,]+$/;
+    if (username && !safePattern.test(username)) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: "Username contains unsafe characters",
+                renderOptions: {
+                    title_color,
+                    text_color,
+                    bg_color,
+                    border_color,
+                    theme,
+                },
+            }),
+        };
+    }
     if (layout !== undefined &&
-        (typeof layout !== "string" ||
-            !["compact", "normal", "donut", "donut-vertical", "pie"].includes(layout))) {
+        !["compact", "normal", "donut", "donut-vertical", "pie"].includes(layout)) {
         return {
             status: "error - permanent",
             content: renderError({
@@ -42,8 +74,7 @@ export default async ({ username, hide, hide_title, hide_border, card_width, tit
         };
     }
     if (stats_format !== undefined &&
-        (typeof stats_format !== "string" ||
-            !["bytes", "percentages"].includes(stats_format))) {
+        !["bytes", "percentages"].includes(stats_format)) {
         return {
             status: "error - permanent",
             content: renderError({

package/build/api/wakatime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wakatime.d.ts","sourceRoot":"","sources":["../../src/api/wakatime.js"],"names":[],"mappings":"AAae;;;;;;;;;;;;;;;;;;;;;;;;;GAmGd"}
+{"version":3,"file":"wakatime.d.ts","sourceRoot":"","sources":["../../src/api/wakatime.js"],"names":[],"mappings":"AAYe;;;;;;;;;;;;;;;;;;;;;;;;;GAsId"}

package/build/api/wakatime.js

@@ -1,5 +1,5 @@
-// @ts-check
 import { renderWakatimeCard } from "../cards/wakatime.js";
+import { findInvalidColor } from "../common/color.js";
 import { MissingParamError, retrieveSecondaryMessage, } from "../common/error.js";
 import { parseArray, parseBoolean } from "../common/ops.js";
 import { renderError } from "../common/render.js";
@@ -7,6 +7,22 @@ import { fetchWakatimeStats } from "../fetchers/wakatime.js";
 import { isLocaleAvailable } from "../translations.js";
 // @ts-ignore
 export default async ({ username, title_color, icon_color, hide_border, card_width, line_height, text_color, bg_color, theme, hide_title, hide_progress, custom_title, locale, layout, langs_count, hide, api_domain, border_radius, border_color, display_format, disable_animations, }) => {
+    const invalidColorInput = findInvalidColor({
+        title_color,
+        icon_color,
+        text_color,
+        bg_color,
+        border_color,
+    });
+    if (invalidColorInput) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+            }),
+        };
+    }
     if (locale && !isLocaleAvailable(locale)) {
         return {
             status: "error - permanent",
@@ -23,6 +39,23 @@ export default async ({ username, title_color, icon_color, hide_border, card_wid
             }),
         };
     }
+    const safePattern = /^[-\w/.,]+$/;
+    if (username && !safePattern.test(username)) {
+        return {
+            status: "error - permanent",
+            content: renderError({
+                message: "Something went wrong",
+                secondaryMessage: "Username contains unsafe characters",
+                renderOptions: {
+                    title_color,
+                    text_color,
+                    bg_color,
+                    border_color,
+                    theme,
+                },
+            }),
+        };
+    }
     try {
         const stats = await fetchWakatimeStats({ username, api_domain });
         return {

package/build/calculateRank.d.ts

@@ -1,18 +1,18 @@
 /**
  * Calculates the users rank.
  *
- * @param {object} params Parameters on which the user's rank depends.
- * @param {boolean} params.all_commits Whether `include_all_commits` was used.
- * @param {number} params.commits Number of commits.
- * @param {number} params.prs The number of pull requests.
- * @param {number} params.issues The number of issues.
- * @param {number} params.reviews The number of reviews.
- * @param {number} params.repos Total number of repos.
- * @param {number} params.stars The number of stars.
- * @param {number} params.followers The number of followers.
- * @returns {{ level: string, percentile: number }} The users rank.
+ * @param params Parameters on which the user's rank depends.
+ * @param params.all_commits Whether `include_all_commits` was used.
+ * @param params.commits Number of commits.
+ * @param params.prs The number of pull requests.
+ * @param params.issues The number of issues.
+ * @param params.reviews The number of reviews.
+ * @param params.repos Total number of repos (accepted for compatibility, unused in the calculation).
+ * @param params.stars The number of stars.
+ * @param params.followers The number of followers.
+ * @returns The users rank.
  */
-export function calculateRank({ all_commits, commits, prs, issues, reviews, repos, stars, followers, }: {
+declare function calculateRank({ all_commits, commits, prs, issues, reviews, stars, followers, }: {
     all_commits: boolean;
     commits: number;
     prs: number;
@@ -25,4 +25,5 @@ export function calculateRank({ all_commits, commits, prs, issues, reviews, repo
     level: string;
     percentile: number;
 };
+export { calculateRank };
 //# sourceMappingURL=calculateRank.d.ts.map

package/build/calculateRank.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"calculateRank.d.ts","sourceRoot":"","sources":["../src/calculateRank.js"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;GAaG;AACH,wGAVG;IAAwB,WAAW,EAA3B,OAAO;IACQ,OAAO,EAAtB,MAAM;IACS,GAAG,EAAlB,MAAM;IACS,MAAM,EAArB,MAAM;IACS,OAAO,EAAtB,MAAM;IACS,KAAK,EAApB,MAAM;IACS,KAAK,EAApB,MAAM;IACS,SAAS,EAAxB,MAAM;CACd,GAAU;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAkDjD"}
+{"version":3,"file":"calculateRank.d.ts","sourceRoot":"","sources":["../src/calculateRank.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;GAaG;AACH,iBAAS,aAAa,CAAC,EACrB,WAAW,EACX,OAAO,EACP,GAAG,EACH,MAAM,EACN,OAAO,EACP,KAAK,EACL,SAAS,GACV,EAAE;IACD,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAyCxC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/build/calculateRank.js

@@ -1,8 +1,8 @@
 /**
  * Calculates the exponential cdf.
  *
- * @param {number} x The value.
- * @returns {number} The exponential cdf.
+ * @param x The value.
+ * @returns The exponential cdf.
  */
 function exponential_cdf(x) {
     return 1 - 2 ** -x;
@@ -10,8 +10,8 @@ function exponential_cdf(x) {
 /**
  * Calculates the log normal cdf.
  *
- * @param {number} x The value.
- * @returns {number} The log normal cdf.
+ * @param x The value.
+ * @returns The log normal cdf.
  */
 function log_normal_cdf(x) {
     // approximation
@@ -20,21 +20,18 @@ function log_normal_cdf(x) {
 /**
  * Calculates the users rank.
  *
- * @param {object} params Parameters on which the user's rank depends.
- * @param {boolean} params.all_commits Whether `include_all_commits` was used.
- * @param {number} params.commits Number of commits.
- * @param {number} params.prs The number of pull requests.
- * @param {number} params.issues The number of issues.
- * @param {number} params.reviews The number of reviews.
- * @param {number} params.repos Total number of repos.
- * @param {number} params.stars The number of stars.
- * @param {number} params.followers The number of followers.
- * @returns {{ level: string, percentile: number }} The users rank.
+ * @param params Parameters on which the user's rank depends.
+ * @param params.all_commits Whether `include_all_commits` was used.
+ * @param params.commits Number of commits.
+ * @param params.prs The number of pull requests.
+ * @param params.issues The number of issues.
+ * @param params.reviews The number of reviews.
+ * @param params.repos Total number of repos (accepted for compatibility, unused in the calculation).
+ * @param params.stars The number of stars.
+ * @param params.followers The number of followers.
+ * @returns The users rank.
  */
-function calculateRank({ all_commits, commits, prs, issues, reviews, 
-// eslint-disable-next-line no-unused-vars
-repos, // unused
-stars, followers, }) {
+function calculateRank({ all_commits, commits, prs, issues, reviews, stars, followers, }) {
     const COMMITS_MEDIAN = all_commits ? 1000 : 250, COMMITS_WEIGHT = 2;
     const PRS_MEDIAN = 50, PRS_WEIGHT = 3;
     const ISSUES_MEDIAN = 25, ISSUES_WEIGHT = 1;
@@ -58,6 +55,9 @@ stars, followers, }) {
             FOLLOWERS_WEIGHT * log_normal_cdf(followers / FOLLOWERS_MEDIAN)) /
             TOTAL_WEIGHT;
     const level = LEVELS[THRESHOLDS.findIndex((t) => rank * 100 <= t)];
+    if (level === undefined) {
+        throw new Error("Unable to determine rank level");
+    }
     return { level, percentile: rank * 100 };
 }
 export { calculateRank };

package/build/cards/gist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gist.d.ts","sourceRoot":"","sources":["../../src/cards/gist.js"],"names":[],"mappings":";;;;;;;;AA4BA;;;GAGG;AAEH;;;;;;GAMG;AACH,yCAJW,QAAQ,YACR,OAAO,CAAC,eAAe,CAAC,GACtB,MAAM,CAkJlB"}
+{"version":3,"file":"gist.d.ts","sourceRoot":"","sources":["../../src/cards/gist.js"],"names":[],"mappings":";;;;;;;;AA0BA;;;GAGG;AAEH;;;;;;GAMG;AACH,yCAJW,QAAQ,YACR,OAAO,CAAC,eAAe,CAAC,GACtB,MAAM,CAkJlB"}

package/build/cards/gist.js

@@ -1,4 +1,3 @@
-// @ts-check
 import { default as Card } from "../common/Card.js";
 import { getCardColors } from "../common/color.js";
 import { kFormatter, wrapTextMultiline } from "../common/fmt.js";

package/build/cards/repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/cards/repo.js"],"names":[],"mappings":";;;;;;;;AAmDA;;;GAGG;AAEH;;;;;;GAMG;AACH,qCAJW,cAAc,YACd,OAAO,CAAC,eAAe,CAAC,GACtB,MAAM,CA6SlB"}
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/cards/repo.js"],"names":[],"mappings":";;;;;;;;AA0DA;;;GAGG;AAEH;;;;;;GAMG;AACH,qCAJW,cAAc,YACd,OAAO,CAAC,eAAe,CAAC,GACtB,MAAM,CA8SlB"}

package/build/cards/repo.js

@@ -1,7 +1,6 @@
-// @ts-check
 import { Card } from "../common/Card.js";
 import { I18n } from "../common/I18n.js";
-import { getCardColors } from "../common/color.js";
+import { getCardColors, isPrefixedHexColor } from "../common/color.js";
 import { kFormatter, wrapTextMultiline } from "../common/fmt.js";
 import { encodeHTML } from "../common/html.js";
 import { icons } from "../common/icons.js";
@@ -22,20 +21,28 @@ const DESCRIPTION_MAX_LINES = 3;
  * @param {string} textColor The color of the text.
  * @returns {string} Wrapped repo description SVG object.
  */
-const getBadgeSVG = (label, textColor, xOffset = 0) => `
-  <g data-testid="badge" class="badge" transform="translate(${320 + xOffset}, -18)">
-    <rect stroke="${textColor}" stroke-width="1" width="70" height="20" x="-12" y="-14" ry="10" rx="10"></rect>
-    <text
-      x="23" y="-5"
-      alignment-baseline="central"
-      dominant-baseline="central"
-      text-anchor="middle"
-      fill="${textColor}"
-    >
-      ${label}
-    </text>
-  </g>
-`;
+const getBadgeSVG = (label, textColor, xOffset = 0) => {
+    if (!isPrefixedHexColor(textColor)) {
+        throw new Error(`Invalid text color: "${textColor}"`);
+    }
+    if (!Number.isFinite(xOffset)) {
+        throw new Error(`Invalid xOffset: "${xOffset}"`);
+    }
+    return `
+    <g data-testid="badge" class="badge" transform="translate(${320 + xOffset}, -18)">
+      <rect stroke="${textColor}" stroke-width="1" width="70" height="20" x="-12" y="-14" ry="10" rx="10"></rect>
+      <text
+        x="23" y="-5"
+        alignment-baseline="central"
+        dominant-baseline="central"
+        text-anchor="middle"
+        fill="${textColor}"
+      >
+        ${encodeHTML(label)}
+      </text>
+    </g>
+  `;
+};
 /**
  * @typedef {import("../fetchers/types").RepositoryData} RepositoryData Repository data.
  * @typedef {import("./types").RepoCardOptions} RepoCardOptions Repo card options.
@@ -60,6 +67,7 @@ const renderRepoCard = (repo, options = {}) => {
         translations: repoCardLocales,
     });
     let repoFilter = encodeURIComponent(buildSearchFilter([nameWithOwner], []));
+    const encodedUsername = encodeURIComponent(username);
     const STATS = {};
     if (show.includes("prs_authored")) {
         STATS.prs_authored = {
@@ -67,7 +75,7 @@ const renderRepoCard = (repo, options = {}) => {
             label: i18n.t("repocard.prs-authored"),
             value: totalPRsAuthored,
             id: "prs_authored",
-            link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=pullrequests`,
+            link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=pullrequests`,
         };
     }
     if (show.includes("prs_commented")) {
@@ -76,7 +84,7 @@ const renderRepoCard = (repo, options = {}) => {
             label: i18n.t("repocard.prs-commented"),
             value: totalPRsCommented,
             id: "prs_commented",
-            link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+            link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
         };
     }
     if (show.includes("prs_reviewed")) {
@@ -85,7 +93,7 @@ const renderRepoCard = (repo, options = {}) => {
             label: i18n.t("repocard.prs-reviewed"),
             value: totalPRsReviewed,
             id: "prs_reviewed",
-            link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+            link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
         };
     }
     if (show.includes("issues_authored")) {
@@ -94,7 +102,7 @@ const renderRepoCard = (repo, options = {}) => {
             label: i18n.t("repocard.issues-authored"),
             value: totalIssuesAuthored,
             id: "issues_authored",
-            link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=issues`,
+            link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=issues`,
         };
     }
     if (show.includes("issues_commented")) {
@@ -103,7 +111,7 @@ const renderRepoCard = (repo, options = {}) => {
             label: i18n.t("repocard.issues-commented"),
             value: totalIssuesCommented,
             id: "issues_commented",
-            link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=issues`,
+            link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=issues`,
         };
     }
     const statItems = Object.keys(STATS).map((key, index) => 

package/build/cards/stats.d.ts

@@ -15,8 +15,10 @@ export function renderStatsCard(stats: StatsData, options: Partial<StatCardOptio
 /**
  * Create a stats card text item.
  *
+ * The caller must ensure that the passed `icon` and `link` are properly sanitized!
+ *
  * @param {object} params Object that contains the createTextNode parameters.
- * @param {string} params.icon The icon to display.
+ * @param {string} params.icon The sanitized icon to display.
  * @param {string} params.label The label to display.
  * @param {number} params.value The value to display.
  * @param {string} params.id The id of the stat.
@@ -27,7 +29,7 @@ export function renderStatsCard(stats: StatsData, options: Partial<StatCardOptio
  * @param {boolean} params.bold Whether to bold the label.
  * @param {string} params.numberFormat The format of numbers on card.
  * @param {number=} params.numberPrecision The precision of numbers on card.
- * @param {string} params.link Url to link to.
+ * @param {string} params.link Sanitized url to link to.
  * @param {number} params.labelXOffset horizontal offset for label.
  * @returns {string} The stats card text item SVG object.
  */

package/build/cards/stats.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/cards/stats.js"],"names":[],"mappings":";;AA8PA;;;GAGG;AAEH;;;;;;GAMG;AACH,uCAJW,SAAS,WACT,OAAO,CAAC,eAAe,CAAC,+CACtB,MAAM,CAsZlB;AAzmBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,kKAfG;IAAuB,IAAI,EAAnB,MAAM;IACS,KAAK,EAApB,MAAM;IACS,KAAK,EAApB,MAAM;IACS,EAAE,EAAjB,MAAM;IACU,UAAU,GAA1B,MAAM,YAAC;IACQ,KAAK,EAApB,MAAM;IACU,SAAS,EAAzB,OAAO;IACQ,aAAa,EAA5B,MAAM;IACU,IAAI,EAApB,OAAO;IACQ,YAAY,EAA3B,MAAM;IACU,eAAe,GAA/B,MAAM,YAAC;IACQ,IAAI,EAAnB,MAAM;IACS,YAAY,EAA3B,MAAM;CACd,GAAU,MAAM,CAuDlB"}
+{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../src/cards/stats.js"],"names":[],"mappings":";;AAyQA;;;GAGG;AAEH;;;;;;GAMG;AACH,uCAJW,SAAS,WACT,OAAO,CAAC,eAAe,CAAC,+CACtB,MAAM,CAuZlB;AAtnBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,kKAfG;IAAuB,IAAI,EAAnB,MAAM;IACS,KAAK,EAApB,MAAM;IACS,KAAK,EAApB,MAAM;IACS,EAAE,EAAjB,MAAM;IACU,UAAU,GAA1B,MAAM,YAAC;IACQ,KAAK,EAApB,MAAM;IACU,SAAS,EAAzB,OAAO;IACQ,aAAa,EAA5B,MAAM;IACU,IAAI,EAApB,OAAO;IACQ,YAAY,EAA3B,MAAM;IACU,eAAe,GAA/B,MAAM,YAAC;IACQ,IAAI,EAAnB,MAAM;IACS,YAAY,EAA3B,MAAM;CACd,GAAU,MAAM,CAiElB"}

package/build/cards/stats.js

@@ -1,9 +1,9 @@
-// @ts-check
 import { Card } from "../common/Card.js";
 import { I18n } from "../common/I18n.js";
 import { getCardColors } from "../common/color.js";
 import { CustomError } from "../common/error.js";
 import { kFormatter } from "../common/fmt.js";
+import { encodeHTML } from "../common/html.js";
 import { icons, rankIcon } from "../common/icons.js";
 import { buildSearchFilter, clampValue } from "../common/ops.js";
 import { flexLayout, measureText } from "../common/render.js";
@@ -50,8 +50,10 @@ const LONG_LOCALES = [
 /**
  * Create a stats card text item.
  *
+ * The caller must ensure that the passed `icon` and `link` are properly sanitized!
+ *
  * @param {object} params Object that contains the createTextNode parameters.
- * @param {string} params.icon The icon to display.
+ * @param {string} params.icon The sanitized icon to display.
  * @param {string} params.label The label to display.
  * @param {number} params.value The value to display.
  * @param {string} params.id The id of the stat.
@@ -62,11 +64,20 @@ const LONG_LOCALES = [
  * @param {boolean} params.bold Whether to bold the label.
  * @param {string} params.numberFormat The format of numbers on card.
  * @param {number=} params.numberPrecision The precision of numbers on card.
- * @param {string} params.link Url to link to.
+ * @param {string} params.link Sanitized url to link to.
  * @param {number} params.labelXOffset horizontal offset for label.
  * @returns {string} The stats card text item SVG object.
  */
 const createTextNode = ({ icon, label, value, id, unitSymbol, index, showIcons, shiftValuePos, bold, numberFormat, numberPrecision, link, labelXOffset = 25, }) => {
+    if (!Number.isFinite(labelXOffset)) {
+        throw new Error(`Invalid labelXOffset: "${labelXOffset}"`);
+    }
+    if (!Number.isFinite(shiftValuePos)) {
+        throw new Error(`Invalid shiftValuePos: "${shiftValuePos}"`);
+    }
+    if (!Number.isFinite(index)) {
+        throw new Error(`Invalid index: "${index}"`);
+    }
     const precision = typeof numberPrecision === "number" && !isNaN(numberPrecision)
         ? clampValue(numberPrecision, 0, 2)
         : undefined;
@@ -87,7 +98,7 @@ const createTextNode = ({ icon, label, value, id, unitSymbol, index, showIcons,
         (link ? `<a href="${link}">` : "") +
         `
       ${iconSvg}
-      <text class="stat ${bold ? " bold" : "not_bold"}" ${labelOffset} y="12.5">${label}:</text>
+      <text class="stat ${bold ? " bold" : "not_bold"}" ${labelOffset} y="12.5">${encodeHTML(label)}:</text>
       <text
         class="stat ${bold ? " bold" : "not_bold"}"
         x="${(showIcons ? 140 : 120) + (bold ? 5 : 0) + shiftValuePos}"
@@ -316,13 +327,14 @@ const renderStatsCard = (stats, options = {}, username, repo = [], owner = []) =
         };
     }
     let repoFilter = encodeURIComponent(buildSearchFilter(repo, owner));
+    const encodedUsername = encodeURIComponent(username);
     if (show.includes("prs_authored")) {
         STATS.prs_authored = {
             icon: icons.prs,
             label: i18n.t("statcard.prs-authored"),
             value: totalPRsAuthored,
             id: "prs_authored",
-            link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=pullrequests`,
+            link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=pullrequests`,
         };
     }
     if (show.includes("prs_commented")) {
@@ -331,7 +343,7 @@ const renderStatsCard = (stats, options = {}, username, repo = [], owner = []) =
             label: i18n.t("statcard.prs-commented"),
             value: totalPRsCommented,
             id: "prs_commented",
-            link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+            link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
         };
     }
     if (show.includes("prs_reviewed")) {
@@ -340,7 +352,7 @@ const renderStatsCard = (stats, options = {}, username, repo = [], owner = []) =
             label: i18n.t("statcard.prs-reviewed"),
             value: totalPRsReviewed,
             id: "prs_reviewed",
-            link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+            link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
         };
     }
     if (show.includes("issues_authored")) {
@@ -349,7 +361,7 @@ const renderStatsCard = (stats, options = {}, username, repo = [], owner = []) =
             label: i18n.t("statcard.issues-authored"),
             value: totalIssuesAuthored,
             id: "issues_authored",
-            link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=issues`,
+            link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=issues`,
         };
     }
     if (show.includes("issues_commented")) {
@@ -358,7 +370,7 @@ const renderStatsCard = (stats, options = {}, username, repo = [], owner = []) =
             label: i18n.t("statcard.issues-commented"),
             value: totalIssuesCommented,
             id: "issues_commented",
-            link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=issues`,
+            link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=issues`,
         };
     }
     STATS.contribs = {

package/build/cards/top-languages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"top-languages.d.ts","sourceRoot":"","sources":["../../src/cards/top-languages.js"],"names":[],"mappings":";;qBAswBa,cAAc,CAAC,QAAQ,CAAC;;AA3uBrC;;GAEG;AAEH;;;;;GAKG;AACH,oCAHW,IAAI,EAAE,GACJ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOvD;AAEH;;;;;GAKG;AACH,iDAHW,MAAM,GACJ,MAAM,CAE4D;AAE/E;;;;;GAKG;AACH,iDAHW,MAAM,GACJ,MAAM,CAE4D;AAE/E;;;;;;;;GAQG;AACH,0CANW,MAAM,WACN,MAAM,UACN,MAAM,kBACN,MAAM,GACJ;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAC,CAQlC;AAED;;;;;;;;GAQG;AACH,0CANW,MAAM,WACN,MAAM,KACN,MAAM,KACN,MAAM,GACJ;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CASpD;AAED;;;;;GAKG;AACH,wCAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,yDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,uDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,+DAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,qDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;GAIG;AACH,mDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;;;GAOG;AACH,2CALW,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eACpB,MAAM,SACN,MAAM,EAAE,YAAC,GACP;IAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CA4BxD;AA0mBD;;GAEG;AAEH;;;;;;GAMG;AACH,6CAJW,WAAW,YACX,OAAO,CAAC,cAAc,CAAC,GACrB,MAAM,CAkLlB;AA59BD,6BAAuB,GAAG,CAAC;AA2wB3B;;;;;;;GAOG;AACH,4EAJG;IAAuB,MAAM,GAArB,MAAM,YAAC;IACS,aAAa,GAA7B,OAAO,YAAC;CAChB,GAAU,MAAM,CAclB"}
+{"version":3,"file":"top-languages.d.ts","sourceRoot":"","sources":["../../src/cards/top-languages.js"],"names":[],"mappings":";;qBAsyBa,cAAc,CAAC,QAAQ,CAAC;;AAxwBrC;;GAEG;AAEH;;;;;GAKG;AACH,oCAHW,IAAI,EAAE,GACJ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOvD;AAEH;;;;;GAKG;AACH,iDAHW,MAAM,GACJ,MAAM,CAE4D;AAE/E;;;;;GAKG;AACH,iDAHW,MAAM,GACJ,MAAM,CAE4D;AAE/E;;;;;;;;GAQG;AACH,0CANW,MAAM,WACN,MAAM,UACN,MAAM,kBACN,MAAM,GACJ;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAC,CAQlC;AAED;;;;;;;;GAQG;AACH,0CANW,MAAM,WACN,MAAM,KACN,MAAM,KACN,MAAM,GACJ;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CASpD;AAED;;;;;GAKG;AACH,wCAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,yDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,wDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,uDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,+DAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;GAKG;AACH,qDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;GAIG;AACH,mDAHW,MAAM,GACJ,MAAM,CAIlB;AAED;;;;;;;GAOG;AACH,2CALW,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eACpB,MAAM,SACN,MAAM,EAAE,YAAC,GACP;IAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CA4BxD;AA2oBD;;GAEG;AAEH;;;;;;GAMG;AACH,6CAJW,WAAW,YACX,OAAO,CAAC,cAAc,CAAC,GACrB,MAAM,CAkLlB;AA7/BD,6BAAuB,GAAG,CAAC;AA4yB3B;;;;;;;GAOG;AACH,4EAJG;IAAuB,MAAM,GAArB,MAAM,YAAC;IACS,aAAa,GAA7B,OAAO,YAAC;CAChB,GAAU,MAAM,CAclB"}