fix(github): cap max pages in fetchUserRepos to prevent DoS (JhaSourav07#591)

* fix(svg): sanitize hex colors in monthly badge to prevent XSS

* fix(github): cap max pages in fetchUserRepos to prevent DoS

Author: riddhima25bet10005-a11y

lib/github.test.ts

@@ -268,7 +268,7 @@ describe('fetchUserRepos', () => {
 
     await fetchUserRepos('octocat');
 
-    expect(fetch).toHaveBeenCalledTimes(100);
+    expect(fetch).toHaveBeenCalledTimes(3);
   });
 });
 

lib/github.ts

@@ -272,7 +272,7 @@ export async function fetchUserRepos(
   const allRepos: GitHubRepo[] = [];
 
   let PAGE = 1;
-  const MAX_PAGES = 100;
+  const MAX_PAGES = 3; // Hard cap at 3 pages (300 repos) to prevent API rate limit exhaustion (DoS)
   while (PAGE <= MAX_PAGES) {
     const res = await fetchWithRetry(
       `${GITHUB_REST_URL}/users/${username}/repos?per_page=100&page=${PAGE}&sort=pushed`,

lib/svg/generator.ts

@@ -334,9 +334,9 @@ export function generateMonthlySVG(stats: MonthlyStats, params: BadgeParams): st
   }
 
   const safeUser = escapeXML(params.user || 'GitHub User');
-  const bg = `#${(params.bg || '0d1117').replace('#', '')}`;
-  const accent = `#${(params.accent || '00ffaa').replace('#', '')}`;
-  const text = `#${(params.text || 'ffffff').replace('#', '')}`;
+  const bg = `#${sanitizeHexColor(params.bg, '0d1117')}`;
+  const accent = `#${sanitizeHexColor(params.accent, '00ffaa')}`;
+  const text = `#${sanitizeHexColor(params.text, 'ffffff')}`;
 
   const sanitizeFont = (name: string) => name.replace(/[^a-zA-Z0-9\s-]/g, '').trim();
   const sanitizedFont = params.font ? sanitizeFont(params.font) : null;