From 3c7931b8938b809a61d8c56d5467e60dc9acbaf3 Mon Sep 17 00:00:00 2001
From: Masonlet <masonletoile@hotmail.com>
Date: Sun, 12 Jul 2026 17:53:46 -0400
Subject: [PATCH 1/6] fix: escape title in renderSvg

---
 src/render/svg.ts          | 3 ++-
 src/utils/params.ts        | 3 +--
 tests/render/svg.test.ts   | 6 ++++++
 tests/utils/params.test.ts | 6 +++---
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/render/svg.ts b/src/render/svg.ts
index 24847a1..249ea05 100644
--- a/src/render/svg.ts
+++ b/src/render/svg.ts
@@ -1,5 +1,6 @@
 import { TITLE_STYLES     } from "../constants/styles.js";
 import type { ChartResult } from "../charts/types.js";
+import { sanitize         } from "../utils/sanitize.js";
 
 export function renderSvg(
   width: number, height: number, background: string,
@@ -12,7 +13,7 @@ export function renderSvg(
       text-anchor="middle" fill="${textColour}"
       font-family="Arial" font-size="${TITLE_STYLES.FONT_SIZE}"
     >
-      ${title}
+      ${sanitize(title)}
     </text>
   ` : '';
 
diff --git a/src/utils/params.ts b/src/utils/params.ts
index 59f33e7..f22e0fc 100644
--- a/src/utils/params.ts
+++ b/src/utils/params.ts
@@ -2,7 +2,6 @@ import { VALID_TYPES                    } from "../constants/types.js";
 import { DEFAULT_CONFIG                 } from "../constants/config.js";
 import { THEMES                         } from "../constants/themes.js";
 import type { ChartType, GapType, Theme } from "../charts/types.js";
-import { sanitize                       } from "./sanitize.js";
 
 export interface ParsedParams {
   chartType:     ChartType;
@@ -62,7 +61,7 @@ export function parseQueryParams(query: QueryParams): ParsedParams {
 
   return {
     chartType,
-    chartTitle:  query["hide_title"] === "true" ? '' : sanitize(query["title"] ?? DEFAULT_CONFIG.TITLE),
+    chartTitle:  query["hide_title"] === "true" ? '' : query["title"] ?? DEFAULT_CONFIG.TITLE,
     width:       Math.max(parseIntSafe(query["width"],  DEFAULT_CONFIG.WIDTH),  DEFAULT_CONFIG.MIN_WIDTH ),
     height:      Math.max(parseIntSafe(query["height"], DEFAULT_CONFIG.HEIGHT), DEFAULT_CONFIG.MIN_HEIGHT),
     count:       Math.min(Math.max(count, 1), DEFAULT_CONFIG.MAX_COUNT),
diff --git a/tests/render/svg.test.ts b/tests/render/svg.test.ts
index 10ff2c6..09c32bb 100644
--- a/tests/render/svg.test.ts
+++ b/tests/render/svg.test.ts
@@ -28,4 +28,10 @@ describe("renderSvg", () => {
     expect(result).toContain(chart.segments);
     expect(result).toContain(chart.legend);
   });
+
+  it("escapes markup in the title", () => {
+    const result = renderSvg(600, 400, "#ffffff", chart, `<script>alert("x")</script>`, "#000000");
+    expect(result).toContain("&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;");
+    expect(result).not.toContain("<script>");
+  });
 });
diff --git a/tests/utils/params.test.ts b/tests/utils/params.test.ts
index 13516e1..4af2626 100644
--- a/tests/utils/params.test.ts
+++ b/tests/utils/params.test.ts
@@ -34,9 +34,9 @@ describe("parseQueryParams", () => {
     expect(params.chartTitle).toBe("");
   });
 
-  it("sanitizes title when provided", () => {
-    const params = parseQueryParams({ title: `<scripts>alert("x")</script>` });
-    expect(params.chartTitle).toBe("&lt;scripts&gt;alert(&quot;x&quot;)&lt;/script&gt;");
+  it("returns title raw", () => {
+    const params = parseQueryParams({ title: `<b>&"'` });
+    expect(params.chartTitle).toBe(`<b>&"'`);
   });
 
   it("clamps count between 1 and MAX_COUNT", () => {

From fee3d233f05a0e6388ec4871594dbdc95fa307e2 Mon Sep 17 00:00:00 2001
From: Masonlet <masonletoile@hotmail.com>
Date: Sun, 12 Jul 2026 18:03:53 -0400
Subject: [PATCH 2/6] fix: escape language names in createLegend

---
 src/charts/legend.ts        | 3 ++-
 tests/charts/legend.test.ts | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/charts/legend.ts b/src/charts/legend.ts
index 426e112..c8e62bc 100644
--- a/src/charts/legend.ts
+++ b/src/charts/legend.ts
@@ -1,6 +1,7 @@
 import { LEGEND_SHIFT_THRESHOLD, LEGEND_STYLES } from "../constants/styles.js";
 import type { Theme, Language, GapType         } from "./types.js";
 import { formatLegendEntry, resolveColour      } from "./helpers.js";
+import { sanitize                              } from "../utils/sanitize.js";
 
 export function createLegend(
   languages:     Language[],
@@ -49,7 +50,7 @@ export function createLegend(
         font-size="${LEGEND_STYLES.FONT_SIZE}"
         font-family="Arial"
       >
-      ${formatLegendEntry(lang, totalPct, gapType)}
+      ${sanitize(formatLegendEntry(lang, totalPct, gapType))}
     </text>
     `;
   }).join('');
diff --git a/tests/charts/legend.test.ts b/tests/charts/legend.test.ts
index 79c82ad..cbe1ce2 100644
--- a/tests/charts/legend.test.ts
+++ b/tests/charts/legend.test.ts
@@ -43,6 +43,13 @@ describe("createLegend", () => {
     expect(result).toContain(`stroke-width="0.5"`);
   });
 
+  it("escapes markup in language names", () => {
+    const langs = [{ lang: `<img src=x onerror=alert(1)>`, pct: 100 }];
+    const result = createLegend(langs, theme, 300, false, 110, "gap");
+    expect(result).toContain("&lt;img src=x onerror=alert(1)&gt; 100.0%");
+    expect(result).not.toContain("<img");
+  });
+
   it("generates rect and text for each language", () => {
     const langs = [
       { lang: "C#", pct: 50 },

From 1aacfc956b559017910be0c067ad5acd84d528c6 Mon Sep 17 00:00:00 2001
From: Masonlet <masonletoile@hotmail.com>
Date: Sun, 12 Jul 2026 18:07:40 -0400
Subject: [PATCH 3/6] test: renderError escaping

---
 tests/render/error.test.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/render/error.test.ts b/tests/render/error.test.ts
index cfe3cd3..d7b5a9a 100644
--- a/tests/render/error.test.ts
+++ b/tests/render/error.test.ts
@@ -27,4 +27,10 @@ describe("renderError", () => {
     expect(result).toContain("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...");
     expect(result).not.toContain("A".repeat(50));
   });
+
+  it("escapes markup in the message", () => {
+    const result = renderError(`<script>"x"</script>`, 400, 300);
+    expect(result).toContain("&lt;script&gt;&quot;x&quot;&lt;/script&gt;");
+    expect(result).not.toContain("<script>");
+  });
 });

From 4465c09961ef9aae12dc5ff2e95ea0a984bf0d63 Mon Sep 17 00:00:00 2001
From: Masonlet <masonletoile@hotmail.com>
Date: Sun, 12 Jul 2026 18:08:53 -0400
Subject: [PATCH 4/6] refactor: rename params resolveColour to
 resolveThemeColour

---
 src/utils/params.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/utils/params.ts b/src/utils/params.ts
index f22e0fc..87236f3 100644
--- a/src/utils/params.ts
+++ b/src/utils/params.ts
@@ -30,7 +30,7 @@ const parseHex = (val: string | undefined, fallback: string): string => {
   return /^#[0-9a-f]{3,8}$/i.test(hex) ? hex : fallback;
 };
 
-const resolveColour = (
+const resolveThemeColour = (
   query: QueryParams,
   theme: Theme,
   key:   "bg" | "text" | "gap"
@@ -66,9 +66,9 @@ export function parseQueryParams(query: QueryParams): ParsedParams {
     height:      Math.max(parseIntSafe(query["height"], DEFAULT_CONFIG.HEIGHT), DEFAULT_CONFIG.MIN_HEIGHT),
     count:       Math.min(Math.max(count, 1), DEFAULT_CONFIG.MAX_COUNT),
     selectedTheme: {
-      bg:      resolveColour(query, baseTheme, "bg"),
-      text:    resolveColour(query, baseTheme, "text"),
-      gap:     resolveColour(query, baseTheme, "gap"),
+      bg:      resolveThemeColour(query, baseTheme, "bg"),
+      text:    resolveThemeColour(query, baseTheme, "text"),
+      gap:     resolveThemeColour(query, baseTheme, "gap"),
       colours,
     },
     gapType:     (["gap", "grow", "adapt"] as const).includes(query["gap_type"] as GapType) ? query["gap_type"] as GapType : "gap",

From 4e01bb8d715d1b356dc6ce3c1c3c98b1becaf2c7 Mon Sep 17 00:00:00 2001
From: Masonlet <masonletoile@hotmail.com>
Date: Sun, 12 Jul 2026 18:09:45 -0400
Subject: [PATCH 5/6] chore: bump v1.2.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index cccdc67..d58060c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gh-top-languages/lib",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Library for gh-top-languages — chart generation, SVG output, and parameter parsing",
   "keywords": [
     "svg",

From faf88fc9cf095cc9763a4c608445f3ab78b6caa1 Mon Sep 17 00:00:00 2001
From: Masonlet <masonletoile@hotmail.com>
Date: Sun, 12 Jul 2026 18:14:57 -0400
Subject: [PATCH 6/6] docs: add escaping note, adjust title behaviour

---
 README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ab94dab..cbcb3e8 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,10 @@ Shipped in the package but not part of the public API:
 | `charts/legend.js`      | Legend element generation                 |
 | `charts/layout.js`      | Shared layout calculations                |
 
+### Escaping
+`renderSvg`, `renderError`, and legend generation HTML-escape their text
+inputs (title, error message, language names).
+
 ## Query parameters
 All parsing lives in `parseQueryParams`(utils/params.js), invalid params fall back to defaults.
 
@@ -44,7 +48,7 @@ All parsing lives in `parseQueryParams`(utils/params.js), invalid params fall ba
 | bg, text, gap, c1 - c16  | from theme | Accepts a theme name, or a hex value (3-8 digits with or without #) |
 | gap_type       | gap           | `gap`, `grow`, or `adapt`                 |
 | stroke         | false         | Adds a black outline to slices and legend squares. |
-| title          | Top Languages | HTML-escaped                              |
+| title          | Top Languages | Custom SVG title                          |
 | hide_title     | false         | If `true` title is not rendered           |
 | width / height | 400 / 300     | Integers, minimums: width 400, height 265 |