@stats-organization/github-readme-stats-core 2.1.3 → 2.1.5

package/build/translations.js

@@ -1,16 +1,15 @@
-// @ts-check
 import { encodeHTML } from "./common/html.js";
 /**
  * Retrieves stat card labels in the available locales.
  *
- * @param {object} props Function arguments.
- * @param {string} props.name The name of the locale.
- * @param {string} props.apostrophe Whether to use apostrophe or not.
- * @returns {object} The locales object.
+ * @param props Function arguments.
+ * @param props.name The name of the locale.
+ * @param props.apostrophe Whether to use apostrophe or not.
+ * @returns The locales object.
  *
  * @see https://www.andiamo.co.uk/resources/iso-language-codes/ for language codes.
  */
-const statCardLocales = ({ name, apostrophe }) => {
+const statCardLocales = ({ name, apostrophe, }) => {
     const encodedName = encodeHTML(name);
     return {
         "statcard.title": {
@@ -1131,8 +1130,8 @@ const availableLocales = Object.keys(repoCardLocales["repocard.archived"]);
 /**
  * Checks whether the locale is available or not.
  *
- * @param {string} locale The locale to check.
- * @returns {boolean} Boolean specifying whether the locale is available or not.
+ * @param locale The locale to check.
+ * @returns Boolean specifying whether the locale is available or not.
  */
 const isLocaleAvailable = (locale) => {
     return availableLocales.includes(locale.toLowerCase());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stats-organization/github-readme-stats-core",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "type": "module",
   "homepage": "https://github-stats-extended.vercel.app/frontend",
   "bugs": {
@@ -71,12 +71,12 @@
     "@testing-library/jest-dom": "6.9.1",
     "@uppercod/css-to-object": "1.1.1",
     "axios-mock-adapter": "2.1.0",
-    "js-yaml": "4.2.0",
+    "js-yaml": "5.2.1",
     "jsdom": "29.1.1",
-    "vitest": "4.1.8"
+    "vitest": "4.1.10"
   },
   "dependencies": {
-    "axios": "^1.17.0",
+    "axios": "^1.18.1",
     "emoji-name-map": "^2.0.3",
     "github-username-regex": "^1.0.0"
   },

package/src/_emoji-name-map.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `emoji-name-map` ships no type definitions and exposes no `exports` map, so it
+ * cannot be resolved under `nodenext`. Declare the minimal surface used here.
+ */
+declare module "emoji-name-map" {
+  const emojiNameMap: {
+    get(name: string): string | undefined;
+  };
+  export default emojiNameMap;
+}

package/src/api/gist.js

@@ -1,6 +1,5 @@
-// @ts-check
-
 import { renderGistCard } from "../cards/gist.js";
+import { findInvalidColor } from "../common/color.js";
 import {
   MissingParamError,
   retrieveSecondaryMessage,
@@ -28,6 +27,23 @@ export default async (
   },
   pat = null,
 ) => {
+  const invalidColorInput = findInvalidColor({
+    title_color,
+    icon_color,
+    text_color,
+    bg_color,
+    border_color,
+  });
+  if (invalidColorInput) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+      }),
+    };
+  }
+
   if (locale && !isLocaleAvailable(locale)) {
     return {
       status: "error - permanent",
@@ -45,6 +61,24 @@ export default async (
     };
   }
 
+  const safePattern = /^[-\w/.,]+$/;
+  if (id && !safePattern.test(id)) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: "Gist ID contains unsafe characters",
+        renderOptions: {
+          title_color,
+          text_color,
+          bg_color,
+          border_color,
+          theme,
+        },
+      }),
+    };
+  }
+
   try {
     const gistData = await fetchGist(id, pat);
 

package/src/api/index.js

@@ -1,6 +1,5 @@
-// @ts-check
-
 import { renderStatsCard } from "../cards/stats.js";
+import { findInvalidColor } from "../common/color.js";
 import {
   MissingParamError,
   retrieveSecondaryMessage,
@@ -46,6 +45,24 @@ export default async (
   },
   pat = null,
 ) => {
+  const invalidColorInput = findInvalidColor({
+    title_color,
+    ring_color,
+    icon_color,
+    text_color,
+    bg_color,
+    border_color,
+  });
+  if (invalidColorInput) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+      }),
+    };
+  }
+
   if (locale && !isLocaleAvailable(locale)) {
     return {
       status: "error - permanent",

package/src/api/pin.js

@@ -1,6 +1,5 @@
-// @ts-check
-
 import { renderRepoCard } from "../cards/repo.js";
+import { findInvalidColor } from "../common/color.js";
 import {
   MissingParamError,
   retrieveSecondaryMessage,
@@ -36,6 +35,23 @@ export default async (
   },
   pat = null,
 ) => {
+  const invalidColorInput = findInvalidColor({
+    title_color,
+    icon_color,
+    text_color,
+    bg_color,
+    border_color,
+  });
+  if (invalidColorInput) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+      }),
+    };
+  }
+
   if (locale && !isLocaleAvailable(locale)) {
     return {
       status: "error - permanent",

package/src/api/top-langs.js

@@ -1,6 +1,5 @@
-// @ts-check
-
 import { renderTopLanguages } from "../cards/top-languages.js";
+import { findInvalidColor } from "../common/color.js";
 import {
   MissingParamError,
   retrieveSecondaryMessage,
@@ -40,6 +39,23 @@ export default async (
   },
   pat = null,
 ) => {
+  const invalidColorInput = findInvalidColor({
+    title_color,
+    text_color,
+    bg_color,
+    prog_bar_bg_color,
+    border_color,
+  });
+  if (invalidColorInput) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+      }),
+    };
+  }
+
   if (locale && !isLocaleAvailable(locale)) {
     return {
       status: "error - permanent",
@@ -57,10 +73,27 @@ export default async (
     };
   }
 
+  const safePattern = /^[-\w/.,]+$/;
+  if (username && !safePattern.test(username)) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: "Username contains unsafe characters",
+        renderOptions: {
+          title_color,
+          text_color,
+          bg_color,
+          border_color,
+          theme,
+        },
+      }),
+    };
+  }
+
   if (
     layout !== undefined &&
-    (typeof layout !== "string" ||
-      !["compact", "normal", "donut", "donut-vertical", "pie"].includes(layout))
+    !["compact", "normal", "donut", "donut-vertical", "pie"].includes(layout)
   ) {
     return {
       status: "error - permanent",
@@ -80,8 +113,7 @@ export default async (
 
   if (
     stats_format !== undefined &&
-    (typeof stats_format !== "string" ||
-      !["bytes", "percentages"].includes(stats_format))
+    !["bytes", "percentages"].includes(stats_format)
   ) {
     return {
       status: "error - permanent",

package/src/api/wakatime.js

@@ -1,6 +1,5 @@
-// @ts-check
-
 import { renderWakatimeCard } from "../cards/wakatime.js";
+import { findInvalidColor } from "../common/color.js";
 import {
   MissingParamError,
   retrieveSecondaryMessage,
@@ -34,6 +33,23 @@ export default async ({
   display_format,
   disable_animations,
 }) => {
+  const invalidColorInput = findInvalidColor({
+    title_color,
+    icon_color,
+    text_color,
+    bg_color,
+    border_color,
+  });
+  if (invalidColorInput) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: `Invalid color input for parameter "${invalidColorInput}"`,
+      }),
+    };
+  }
+
   if (locale && !isLocaleAvailable(locale)) {
     return {
       status: "error - permanent",
@@ -51,6 +67,24 @@ export default async ({
     };
   }
 
+  const safePattern = /^[-\w/.,]+$/;
+  if (username && !safePattern.test(username)) {
+    return {
+      status: "error - permanent",
+      content: renderError({
+        message: "Something went wrong",
+        secondaryMessage: "Username contains unsafe characters",
+        renderOptions: {
+          title_color,
+          text_color,
+          bg_color,
+          border_color,
+          theme,
+        },
+      }),
+    };
+  }
+
   try {
     const stats = await fetchWakatimeStats({ username, api_domain });
 

package/src/{calculateRank.js → calculateRank.ts}

@@ -1,20 +1,20 @@
 /**
  * Calculates the exponential cdf.
  *
- * @param {number} x The value.
- * @returns {number} The exponential cdf.
+ * @param x The value.
+ * @returns The exponential cdf.
  */
-function exponential_cdf(x) {
+function exponential_cdf(x: number): number {
   return 1 - 2 ** -x;
 }
 
 /**
  * Calculates the log normal cdf.
  *
- * @param {number} x The value.
- * @returns {number} The log normal cdf.
+ * @param x The value.
+ * @returns The log normal cdf.
  */
-function log_normal_cdf(x) {
+function log_normal_cdf(x: number): number {
   // approximation
   return x / (1 + x);
 }
@@ -22,16 +22,16 @@ function log_normal_cdf(x) {
 /**
  * Calculates the users rank.
  *
- * @param {object} params Parameters on which the user's rank depends.
- * @param {boolean} params.all_commits Whether `include_all_commits` was used.
- * @param {number} params.commits Number of commits.
- * @param {number} params.prs The number of pull requests.
- * @param {number} params.issues The number of issues.
- * @param {number} params.reviews The number of reviews.
- * @param {number} params.repos Total number of repos.
- * @param {number} params.stars The number of stars.
- * @param {number} params.followers The number of followers.
- * @returns {{ level: string, percentile: number }} The users rank.
+ * @param params Parameters on which the user's rank depends.
+ * @param params.all_commits Whether `include_all_commits` was used.
+ * @param params.commits Number of commits.
+ * @param params.prs The number of pull requests.
+ * @param params.issues The number of issues.
+ * @param params.reviews The number of reviews.
+ * @param params.repos Total number of repos (accepted for compatibility, unused in the calculation).
+ * @param params.stars The number of stars.
+ * @param params.followers The number of followers.
+ * @returns The users rank.
  */
 function calculateRank({
   all_commits,
@@ -39,11 +39,18 @@ function calculateRank({
   prs,
   issues,
   reviews,
-  // eslint-disable-next-line no-unused-vars
-  repos, // unused
   stars,
   followers,
-}) {
+}: {
+  all_commits: boolean;
+  commits: number;
+  prs: number;
+  issues: number;
+  reviews: number;
+  repos: number;
+  stars: number;
+  followers: number;
+}): { level: string; percentile: number } {
   const COMMITS_MEDIAN = all_commits ? 1000 : 250,
     COMMITS_WEIGHT = 2;
   const PRS_MEDIAN = 50,
@@ -79,6 +86,9 @@ function calculateRank({
       TOTAL_WEIGHT;
 
   const level = LEVELS[THRESHOLDS.findIndex((t) => rank * 100 <= t)];
+  if (level === undefined) {
+    throw new Error("Unable to determine rank level");
+  }
 
   return { level, percentile: rank * 100 };
 }

package/src/cards/gist.js

@@ -1,5 +1,3 @@
-// @ts-check
-
 import { default as Card } from "../common/Card.js";
 import { getCardColors } from "../common/color.js";
 import { kFormatter, wrapTextMultiline } from "../common/fmt.js";

package/src/cards/repo.js

@@ -1,8 +1,6 @@
-// @ts-check
-
 import { Card } from "../common/Card.js";
 import { I18n } from "../common/I18n.js";
-import { getCardColors } from "../common/color.js";
+import { getCardColors, isPrefixedHexColor } from "../common/color.js";
 import { kFormatter, wrapTextMultiline } from "../common/fmt.js";
 import { encodeHTML } from "../common/html.js";
 import { icons } from "../common/icons.js";
@@ -34,20 +32,29 @@ const DESCRIPTION_MAX_LINES = 3;
  * @param {string} textColor The color of the text.
  * @returns {string} Wrapped repo description SVG object.
  */
-const getBadgeSVG = (label, textColor, xOffset = 0) => `
-  <g data-testid="badge" class="badge" transform="translate(${320 + xOffset}, -18)">
-    <rect stroke="${textColor}" stroke-width="1" width="70" height="20" x="-12" y="-14" ry="10" rx="10"></rect>
-    <text
-      x="23" y="-5"
-      alignment-baseline="central"
-      dominant-baseline="central"
-      text-anchor="middle"
-      fill="${textColor}"
-    >
-      ${label}
-    </text>
-  </g>
-`;
+const getBadgeSVG = (label, textColor, xOffset = 0) => {
+  if (!isPrefixedHexColor(textColor)) {
+    throw new Error(`Invalid text color: "${textColor}"`);
+  }
+  if (!Number.isFinite(xOffset)) {
+    throw new Error(`Invalid xOffset: "${xOffset}"`);
+  }
+
+  return `
+    <g data-testid="badge" class="badge" transform="translate(${320 + xOffset}, -18)">
+      <rect stroke="${textColor}" stroke-width="1" width="70" height="20" x="-12" y="-14" ry="10" rx="10"></rect>
+      <text
+        x="23" y="-5"
+        alignment-baseline="central"
+        dominant-baseline="central"
+        text-anchor="middle"
+        fill="${textColor}"
+      >
+        ${encodeHTML(label)}
+      </text>
+    </g>
+  `;
+};
 
 /**
  * @typedef {import("../fetchers/types").RepositoryData} RepositoryData Repository data.
@@ -112,6 +119,7 @@ const renderRepoCard = (repo, options = {}) => {
   });
 
   let repoFilter = encodeURIComponent(buildSearchFilter([nameWithOwner], []));
+  const encodedUsername = encodeURIComponent(username);
   const STATS = {};
   if (show.includes("prs_authored")) {
     STATS.prs_authored = {
@@ -119,7 +127,7 @@ const renderRepoCard = (repo, options = {}) => {
       label: i18n.t("repocard.prs-authored"),
       value: totalPRsAuthored,
       id: "prs_authored",
-      link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=pullrequests`,
+      link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=pullrequests`,
     };
   }
   if (show.includes("prs_commented")) {
@@ -128,7 +136,7 @@ const renderRepoCard = (repo, options = {}) => {
       label: i18n.t("repocard.prs-commented"),
       value: totalPRsCommented,
       id: "prs_commented",
-      link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+      link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
     };
   }
   if (show.includes("prs_reviewed")) {
@@ -137,7 +145,7 @@ const renderRepoCard = (repo, options = {}) => {
       label: i18n.t("repocard.prs-reviewed"),
       value: totalPRsReviewed,
       id: "prs_reviewed",
-      link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+      link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
     };
   }
   if (show.includes("issues_authored")) {
@@ -146,7 +154,7 @@ const renderRepoCard = (repo, options = {}) => {
       label: i18n.t("repocard.issues-authored"),
       value: totalIssuesAuthored,
       id: "issues_authored",
-      link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=issues`,
+      link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=issues`,
     };
   }
   if (show.includes("issues_commented")) {
@@ -155,7 +163,7 @@ const renderRepoCard = (repo, options = {}) => {
       label: i18n.t("repocard.issues-commented"),
       value: totalIssuesCommented,
       id: "issues_commented",
-      link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=issues`,
+      link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=issues`,
     };
   }
 

package/src/cards/stats.js

@@ -1,10 +1,9 @@
-// @ts-check
-
 import { Card } from "../common/Card.js";
 import { I18n } from "../common/I18n.js";
 import { getCardColors } from "../common/color.js";
 import { CustomError } from "../common/error.js";
 import { kFormatter } from "../common/fmt.js";
+import { encodeHTML } from "../common/html.js";
 import { icons, rankIcon } from "../common/icons.js";
 import { buildSearchFilter, clampValue } from "../common/ops.js";
 import { flexLayout, measureText } from "../common/render.js";
@@ -54,8 +53,10 @@ const LONG_LOCALES = [
 /**
  * Create a stats card text item.
  *
+ * The caller must ensure that the passed `icon` and `link` are properly sanitized!
+ *
  * @param {object} params Object that contains the createTextNode parameters.
- * @param {string} params.icon The icon to display.
+ * @param {string} params.icon The sanitized icon to display.
  * @param {string} params.label The label to display.
  * @param {number} params.value The value to display.
  * @param {string} params.id The id of the stat.
@@ -66,7 +67,7 @@ const LONG_LOCALES = [
  * @param {boolean} params.bold Whether to bold the label.
  * @param {string} params.numberFormat The format of numbers on card.
  * @param {number=} params.numberPrecision The precision of numbers on card.
- * @param {string} params.link Url to link to.
+ * @param {string} params.link Sanitized url to link to.
  * @param {number} params.labelXOffset horizontal offset for label.
  * @returns {string} The stats card text item SVG object.
  */
@@ -85,6 +86,16 @@ const createTextNode = ({
   link,
   labelXOffset = 25,
 }) => {
+  if (!Number.isFinite(labelXOffset)) {
+    throw new Error(`Invalid labelXOffset: "${labelXOffset}"`);
+  }
+  if (!Number.isFinite(shiftValuePos)) {
+    throw new Error(`Invalid shiftValuePos: "${shiftValuePos}"`);
+  }
+  if (!Number.isFinite(index)) {
+    throw new Error(`Invalid index: "${index}"`);
+  }
+
   const precision =
     typeof numberPrecision === "number" && !isNaN(numberPrecision)
       ? clampValue(numberPrecision, 0, 2)
@@ -111,7 +122,7 @@ const createTextNode = ({
       ${iconSvg}
       <text class="stat ${
         bold ? " bold" : "not_bold"
-      }" ${labelOffset} y="12.5">${label}:</text>
+      }" ${labelOffset} y="12.5">${encodeHTML(label)}:</text>
       <text
         class="stat ${bold ? " bold" : "not_bold"}"
         x="${(showIcons ? 140 : 120) + (bold ? 5 : 0) + shiftValuePos}"
@@ -424,13 +435,14 @@ const renderStatsCard = (
   }
 
   let repoFilter = encodeURIComponent(buildSearchFilter(repo, owner));
+  const encodedUsername = encodeURIComponent(username);
   if (show.includes("prs_authored")) {
     STATS.prs_authored = {
       icon: icons.prs,
       label: i18n.t("statcard.prs-authored"),
       value: totalPRsAuthored,
       id: "prs_authored",
-      link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=pullrequests`,
+      link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=pullrequests`,
     };
   }
   if (show.includes("prs_commented")) {
@@ -439,7 +451,7 @@ const renderStatsCard = (
       label: i18n.t("statcard.prs-commented"),
       value: totalPRsCommented,
       id: "prs_commented",
-      link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+      link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
     };
   }
   if (show.includes("prs_reviewed")) {
@@ -448,7 +460,7 @@ const renderStatsCard = (
       label: i18n.t("statcard.prs-reviewed"),
       value: totalPRsReviewed,
       id: "prs_reviewed",
-      link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${username}+-author%3A${username}&amp;type=pullrequests`,
+      link: `https://github.com/search?q=${repoFilter}reviewed-by%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=pullrequests`,
     };
   }
   if (show.includes("issues_authored")) {
@@ -457,7 +469,7 @@ const renderStatsCard = (
       label: i18n.t("statcard.issues-authored"),
       value: totalIssuesAuthored,
       id: "issues_authored",
-      link: `https://github.com/search?q=${repoFilter}author%3A${username}&amp;type=issues`,
+      link: `https://github.com/search?q=${repoFilter}author%3A${encodedUsername}&amp;type=issues`,
     };
   }
   if (show.includes("issues_commented")) {
@@ -466,7 +478,7 @@ const renderStatsCard = (
       label: i18n.t("statcard.issues-commented"),
       value: totalIssuesCommented,
       id: "issues_commented",
-      link: `https://github.com/search?q=${repoFilter}commenter%3A${username}+-author%3A${username}&amp;type=issues`,
+      link: `https://github.com/search?q=${repoFilter}commenter%3A${encodedUsername}+-author%3A${encodedUsername}&amp;type=issues`,
     };
   }