martin-mfg · martin-mfg · May 18, 2025 · May 20, 2025 · May 20, 2025 · May 21, 2025
diff --git a/api/index.js b/api/index.js
@@ -13,6 +13,8 @@
 export default async (req, res) => {
   const {
     username,
+    repos,
+    owners,
     hide,
     hide_title,
     hide_border,
@@ -65,8 +67,35 @@
     );
   }
 
+  const safePattern = /^[-\w\/.,]+$/;
+  if (
+    (username && !safePattern.test(username)) ||
+    (repos && !safePattern.test(repos)) ||
+    (owners && !safePattern.test(owners))
+  ) {
+    return res.send(
+      renderError(
+        "Something went wrong",
+        "Username, repository or owner contains unsafe characters",
+        {
+          title_color,
+          text_color,
+          bg_color,
+          border_color,
+          theme,
+        },
+      ),
@@ -381,8 +381,13 @@
  // returns theme based colors with proper overrides and defaults
-  const { titleColor, textColor, bgColor, borderColor } = getCardColors({
-    title_color,
-    text_color,
+  const { 
+    titleColor, 
+    textColor, 
+    bgColor, 
+    borderColor 
+  } = getCardColors({
+    title_color: encodeHTML(title_color),
+    text_color: encodeHTML(text_color),
    icon_color: "",
-    bg_color,
-    border_color,
+    bg_color: encodeHTML(bg_color),
+    border_color: encodeHTML(border_color),
    ring_color: "",
@@ -381,8 +381,13 @@
  // returns theme based colors with proper overrides and defaults
-  const { titleColor, textColor, bgColor, borderColor } = getCardColors({
-    title_color,
-    text_color,
+  const { 
+    titleColor, 
+    textColor, 
+    bgColor, 
+    borderColor 
+  } = getCardColors({
+    title_color: encodeHTML(title_color),
+    text_color: encodeHTML(text_color),
    icon_color: "",
-    bg_color,
-    border_color,
+    bg_color: encodeHTML(bg_color),
+    border_color: encodeHTML(border_color),
    ring_color: "",
+    );
+  }
+
   try {
     const showStats = parseArray(show);
+    const organizations = parseArray(owners);
+    let repositories = parseArray(repos);
+    repositories = repositories.map((repo) =>
+      repo.includes("/") ? repo : `${username}/${repo}`,
+    );
+
     const stats = await fetchStats(
       username,
       parseBoolean(include_all_commits),
@@ -75,6 +104,13 @@
         showStats.includes("prs_merged_percentage"),
       showStats.includes("discussions_started"),
       showStats.includes("discussions_answered"),
+      repositories,
+      organizations,
+      showStats.includes("prs_authored"),
+      showStats.includes("prs_commented"),
+      showStats.includes("prs_reviewed"),
+      showStats.includes("issues_authored"),
+      showStats.includes("issues_commented"),
     );
 
     let cacheSeconds = clampValue(
@@ -92,31 +128,37 @@
     );
 
     return res.send(
-      renderStatsCard(stats, {
-        hide: parseArray(hide),
-        show_icons: parseBoolean(show_icons),
-        hide_title: parseBoolean(hide_title),
-        hide_border: parseBoolean(hide_border),
-        card_width: parseInt(card_width, 10),
-        hide_rank: parseBoolean(hide_rank),
-        include_all_commits: parseBoolean(include_all_commits),
-        line_height,
-        title_color,
-        ring_color,
-        icon_color,
-        text_color,
-        text_bold: parseBoolean(text_bold),
-        bg_color,
-        theme,
-        custom_title,
-        border_radius,
-        border_color,
-        number_format,
-        locale: locale ? locale.toLowerCase() : null,
-        disable_animations: parseBoolean(disable_animations),
-        rank_icon,
-        show: showStats,
-      }),
+      renderStatsCard(
+        stats,
+        {
+          hide: parseArray(hide),
+          show_icons: parseBoolean(show_icons),
+          hide_title: parseBoolean(hide_title),
+          hide_border: parseBoolean(hide_border),
+          card_width: parseInt(card_width, 10),
+          hide_rank: parseBoolean(hide_rank),
+          include_all_commits: parseBoolean(include_all_commits),
+          line_height,
+          title_color,
+          ring_color,
+          icon_color,
+          text_color,
+          text_bold: parseBoolean(text_bold),
+          bg_color,
+          theme,
+          custom_title,
+          border_radius,
+          border_color,
+          number_format,
+          locale: locale ? locale.toLowerCase() : null,
+          disable_animations: parseBoolean(disable_animations),
+          rank_icon,
+          show: showStats,
+        },
+        username,
+        repositories,
+        organizations,
+      ),
@@ -1,2 +1,3 @@
 import { renderStatsCard } from "../src/cards/stats-card.js";
+import escapeHtml from "escape-html";
 import { blacklist } from "../src/common/blacklist.js";
@@ -141,16 +142,16 @@
          line_height,
-          title_color,
-          ring_color,
-          icon_color,
-          text_color,
+          title_color: escapeHtml(title_color),
+          ring_color: escapeHtml(ring_color),
+          icon_color: escapeHtml(icon_color),
+          text_color: escapeHtml(text_color),
          text_bold: parseBoolean(text_bold),
-          bg_color,
-          theme,
-          custom_title,
-          border_radius,
-          border_color,
-          number_format,
-          locale: locale ? locale.toLowerCase() : null,
+          bg_color: escapeHtml(bg_color),
+          theme: escapeHtml(theme),
+          custom_title: escapeHtml(custom_title),
+          border_radius: escapeHtml(border_radius),
+          border_color: escapeHtml(border_color),
+          number_format: escapeHtml(number_format),
+          locale: locale ? escapeHtml(locale.toLowerCase()) : null,
          disable_animations: parseBoolean(disable_animations),
-          rank_icon,
+          rank_icon: escapeHtml(rank_icon),
          show: showStats,
@@ -68,3 +68,4 @@
    "upgrade": "^1.1.0",
-    "word-wrap": "^1.2.5"
+    "word-wrap": "^1.2.5",
+    "escape-html": "^1.0.3"
  },
@@ -1,2 +1,3 @@
 import { renderStatsCard } from "../src/cards/stats-card.js";
+import escapeHtml from "escape-html";
 import { blacklist } from "../src/common/blacklist.js";
@@ -141,16 +142,16 @@
          line_height,
-          title_color,
-          ring_color,
-          icon_color,
-          text_color,
+          title_color: escapeHtml(title_color),
+          ring_color: escapeHtml(ring_color),
+          icon_color: escapeHtml(icon_color),
+          text_color: escapeHtml(text_color),
          text_bold: parseBoolean(text_bold),
-          bg_color,
-          theme,
-          custom_title,
-          border_radius,
-          border_color,
-          number_format,
-          locale: locale ? locale.toLowerCase() : null,
+          bg_color: escapeHtml(bg_color),
+          theme: escapeHtml(theme),
+          custom_title: escapeHtml(custom_title),
+          border_radius: escapeHtml(border_radius),
+          border_color: escapeHtml(border_color),
+          number_format: escapeHtml(number_format),
+          locale: locale ? escapeHtml(locale.toLowerCase()) : null,
          disable_animations: parseBoolean(disable_animations),
-          rank_icon,
+          rank_icon: escapeHtml(rank_icon),
          show: showStats,
@@ -68,3 +68,4 @@
    "upgrade": "^1.1.0",
-    "word-wrap": "^1.2.5"
+    "word-wrap": "^1.2.5",
+    "escape-html": "^1.0.3"
  },
     );
   } catch (err) {
     res.setHeader(

diff --git a/api/pin.js b/api/pin.js
@@ -3,6 +3,7 @@
 import {
   clampValue,
   CONSTANTS,
+  parseArray,
   parseBoolean,
   renderError,
 } from "../src/common/utils.js";
@@ -18,8 +19,14 @@
     icon_color,
     text_color,
     bg_color,
+    card_width,
     theme,
     show_owner,
+    show,
+    show_icons,
+    number_format,
+    text_bold,
+    line_height,
     cache_seconds,
     locale,
     border_radius,
@@ -53,8 +60,37 @@
     );
   }
 
+  const safePattern = /^[-\w\/.,]+$/;
+  if (
+    (username && !safePattern.test(username)) ||
+    (repo && !safePattern.test(repo))
+  ) {
+    return res.send(
+      renderError(
+        "Something went wrong",
+        "Username or repository contains unsafe characters",
+        {
+          title_color,
+          text_color,
+          bg_color,
+          border_color,
+          theme,
+        },
+      ),
+    );
+  }
+
   try {
-    const repoData = await fetchRepo(username, repo);
+    const showStats = parseArray(show);
+    const repoData = await fetchRepo(
+      username,
+      repo,
+      showStats.includes("prs_authored"),
+      showStats.includes("prs_commented"),
+      showStats.includes("prs_reviewed"),
+      showStats.includes("issues_authored"),
+      showStats.includes("issues_commented"),
+    );
 
     let cacheSeconds = clampValue(
       parseInt(cache_seconds || CONSTANTS.PIN_CARD_CACHE_SECONDS, 10),
@@ -80,7 +116,14 @@
         theme,
         border_radius,
         border_color,
+        card_width_input: parseInt(card_width, 10),
         show_owner: parseBoolean(show_owner),
+        show: showStats,
+        show_icons: parseBoolean(show_icons),
+        number_format,
+        text_bold: parseBoolean(text_bold),
+        line_height,
+        username,
         locale: locale ? locale.toLowerCase() : null,
         description_lines_count,
       }),

diff --git a/readme.md b/readme.md
@@ -89,6 +89,7 @@ Please visit [this link](https://give.do/fundraisers/stand-beside-the-victims-of
     - [Hiding individual stats](#hiding-individual-stats)
     - [Showing additional individual stats](#showing-additional-individual-stats)
     - [Showing icons](#showing-icons)
+    - [Filtering by repository and owner](#filtering-by-repository-and-owner)
     - [Themes](#themes)
     - [Customization](#customization)
 - [GitHub Extra Pins](#github-extra-pins)
@@ -161,10 +162,10 @@ You can pass a query parameter `&hide=` to hide any specific stats with comma-se
 
 You can pass a query parameter `&show=` to show any specific additional stats with comma-separated values.
 
-> Options: `&show=reviews,discussions_started,discussions_answered,prs_merged,prs_merged_percentage`
+> Options: `&show=reviews,discussions_started,discussions_answered,prs_merged,prs_merged_percentage,prs_authored,prs_commented,prs_reviewed,issues_authored,issues_commented`
 
 ```md
-![Anurag's GitHub stats](https://github-readme-stats.vercel.app/api?username=anuraghazra&show=reviews,discussions_started,discussions_answered,prs_merged,prs_merged_percentage)
+![Anurag's GitHub stats](https://github-readme-stats.vercel.app/api?username=anuraghazra&show=reviews,discussions_started,discussions_answered,prs_merged,prs_merged_percentage,prs_authored,prs_commented,prs_reviewed,issues_authored,issues_commented)
 ```
 
 ### Showing icons
@@ -175,6 +176,12 @@ To enable icons, you can pass `&show_icons=true` in the query param, like so:
 ![Anurag's GitHub stats](https://github-readme-stats.vercel.app/api?username=anuraghazra&show_icons=true)
 ```
 
+### Filtering by repository and owner
+
+To compute your stats for only a specific repository, you can pass a query parameter `&repos=<user_or_organization>/<repository>`. You can also specify a comma-separated list of multiple repositories, e.g. `&repos=userA/repositoryA,organizationB/repositoryB`. And you can select all repositories owned by specific organizations or users by providing a comma-separated list of owners via the `owners` query parameter, e.g. `&owners=userA,organizationB,organizationC`. The `repos` and `owners` filters are supported by the following items: `commits` (when used with `&include_all_commits=true`), `prs_authored`, `prs_commented`, `prs_reviewed`, `issues_authored` and `issues_commented`. Note that most of these items are not displayed by default, but [you can enable them individually](#showing-additional-individual-stats).
+
+(Some of these mentioned items are similar to other items which are included by default, e.g. `issues_authored` is similar to `issues`. The difference is how these values are fetched - [via GraphQL or via REST API](https://github.com/anuraghazra/github-readme-stats/discussions/1770#number-of-commits-is-incorrect). The default items use GraphQL, but filtering by repository works better via REST API.)
+
 ### Themes
 
 With inbuilt themes, you can customize the look of the card without doing any [manual customization](#customization).
@@ -376,13 +383,15 @@ If we don't support your language, please consider contributing! You can find mo
 | `show_icons` | Shows icons near all stats. | boolean | `false` |
 | `include_all_commits` | Count total commits instead of just the current year commits. | boolean | `false` |
 | `line_height` | Sets the line height between text. | integer | `25` |
-| `exclude_repo` | Excludes specified repositories. | string (comma-separated values) | `null` |
+| `exclude_repo` | Excludes specified repositories. Affects only the count for "Total Stars Earned". | string (comma-separated values) | `null` |
+| `repos` | Count only stats from the specified repositories. Affects only [certain items](#filtering-by-repository-and-owner). | string (comma-separated values) | `null` |
+| `owners` | Count only stats from the specified organizations or users. Affects only [certain items](#filtering-by-repository-and-owner). | string (comma-separated values) | `null` |
 | `custom_title` | Sets a custom title for the card. | string | `<username> GitHub Stats` |
 | `text_bold` | Uses bold text. | boolean | `true` |
 | `disable_animations` | Disables all animations in the card. | boolean | `false` |
 | `ring_color` | Color of the rank circle. | string (hex color) | `2f80ed` |
-| `number_format` | Switches between two available formats for displaying the card values `short` (i.e. `6.6k`) and `long` (i.e. `6626`). | enum | `short` |
-| `show` | Shows [additional items](#showing-additional-individual-stats) on stats card (i.e. `reviews`, `discussions_started`, `discussions_answered`, `prs_merged` or `prs_merged_percentage`). | string (comma-separated values) | `null` |
+| `number_format` | Switches between two available formats for displaying the card values: `short` (i.e. `6.6k`) and `long` (i.e. `6626`). | enum | `short` |
+| `show` | Shows [additional items](#showing-additional-individual-stats) on stats card (i.e. `reviews`, `discussions_started`, `discussions_answered`, `prs_merged` or `prs_merged_percentage`. And the following, which support the `repos` and `owners` filters: `prs_authored`, `prs_commented`, `prs_reviewed`, `issues_authored` or `issues_commented`). | string (comma-separated values) | `null` |
 
 > [!NOTE]\
 > When hide\_rank=`true`, the minimum card width is 270 px + the title length and padding.
@@ -393,6 +402,12 @@ If we don't support your language, please consider contributing! You can find mo
 | --- | --- | --- | --- |
 | `show_owner` | Shows the repo's owner name. | boolean | `false` |
 | `description_lines_count` | Manually set the number of lines for the description. Specified value will be clamped between 1 and 3. If this parameter is not specified, the number of lines will be automatically adjusted according to the actual length of the description. | number | `null` |
+| `card_width` | Sets the card's width manually. | number | `400px  (approx.)` |
+| `show_icons` | Shows icons near all stats enabled via `show`. | boolean | `true` |
+| `line_height` | Sets the line height between stats enabled via `show`. | integer | `22` |
+| `text_bold` | Uses bold text for all stats enabled via `show`. | boolean | `false` |
+| `number_format` | Switches between two available formats for displaying the numbers for all stats enabled via `show`: `short` (i.e. `6.6k`) and `long` (i.e. `6626`). | enum | `short` |
+| `show` | Shows [additional items](#showing-additional-individual-stats) on stats card (i.e. `prs_authored`, `prs_commented`, `prs_reviewed`, `issues_authored` or `issues_commented`). | string (comma-separated values) | `null` |
 
 #### Gist Card Exclusive Options
 
@@ -458,10 +473,18 @@ Endpoint: `api/pin?username=anuraghazra&repo=github-readme-stats`
 
 ![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=anuraghazra\&repo=github-readme-stats)
 
-Use [show\_owner](#repo-card-exclusive-options) query option to include the repo's owner username
+Use [show\_owner](#repo-card-exclusive-options) query option to include the repo's owner username:
 
 ![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=anuraghazra\&repo=github-readme-stats\&show_owner=true)
 
+Use [show](#repo-card-exclusive-options) query option to display the user's contributions to the repository:
+
+![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=anuraghazra\&repo=github-readme-stats\&show=prs_authored,prs_commented,prs_reviewed,issues_authored,issues_commented)
+
+You can also specify the `repo` parameter in the form `<user_or_organization>/<repository>` to pin a repository from any user or organization, not just your own. This allows you to showcase repositories you contributed to, regardless of ownership.
+
+![Readme Card](https://github-readme-stats.vercel.app/api/pin/?username=anuraghazra\&repo=statykjs/statyk\&show_owner=true\&show=prs_authored,prs_commented,prs_reviewed,issues_authored,issues_commented)
+
 # GitHub Gist Pins
 
 GitHub gist pins allow you to pin gists in your GitHub profile using a GitHub readme profile.
@@ -651,7 +674,15 @@ Change the `?username=` value to your [WakaTime](https://wakatime.com) username.
 
 *   Showing additional stats
 
-![Anurag's GitHub stats](https://github-readme-stats.vercel.app/api?username=anuraghazra\&show_icons=true\&show=reviews,discussions_started,discussions_answered,prs_merged,prs_merged_percentage)
+![Anurag's GitHub stats](https://github-readme-stats.vercel.app/api?username=anuraghazra\&show_icons=true\&show=reviews,discussions_started,discussions_answered,prs_merged,prs_merged_percentage,prs_commented,prs_reviewed,issues_commented)
+
+*   Showing stats for a specific repository
+
+![Anurag's GitHub stats for anuraghazra/github-readme-stats](https://github-readme-stats.vercel.app/api?username=anuraghazra\&repos=anuraghazra/github-readme-stats\&hide=prs,issues,stars,commits,contribs\&show=prs_authored,prs_commented,prs_reviewed,issues_authored,issues_commented\&hide_rank=true\&custom_title=Anurag%27s%20Stats%20for%20github-readme-stats\&card_width=370)
+
+*   Showing stats for a specific organization
+
+![Anurag's GitHub stats for razorpay](https://github-readme-stats.vercel.app/api?username=anuraghazra\&owners=razorpay\&hide=prs,issues,stars,commits,contribs\&show=prs_authored,prs_commented,prs_reviewed,issues_authored,issues_commented\&hide_rank=true\&custom_title=Anurag%27s%20Stats%20for%20razorpay\&card_width=370)
 
 *   Showing icons