From ecaf11a50e7d35dc9d44d2df6e02070410d0662e Mon Sep 17 00:00:00 2001
From: Thaddee Tyl <thaddee.tyl@gmail.com>
Date: Wed, 19 Nov 2014 09:40:30 +0100
Subject: [PATCH] Prevent possible invalid colors.

They're only theoretical, but better safe than sad.
---
 badge.js                           | 15 +++++++++------
 server.js                          |  1 +
 templates/default-template.svg     |  6 +++---
 templates/flat-square-template.svg |  6 +++---
 templates/flat-template.svg        |  6 +++---
 5 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/badge.js b/badge.js
index 84c4350..ba0e502 100644
--- a/badge.js
+++ b/badge.js
@@ -52,20 +52,23 @@ function makeImage(data, cb) {
   if (!(data.template + '-' + data.format in templates)) {
     data.template = 'default';
   }
+  if (data.colorscheme) {
+    var pickedColorscheme = colorscheme[data.colorscheme];
+    if (!pickedColorscheme) {
+      pickedColorscheme = colorscheme.red;
+    }
+    data.colorA = pickedColorscheme.colorA;
+    data.colorB = pickedColorscheme.colorB;
+  }
   // String coercion.
   data.text[0] = '' + data.text[0];
   data.text[1] = '' + data.text[1];
-
-  var template = templates[data.template + '-' + data.format];
-  if (data.colorscheme) {
-    data.colorA = colorscheme[data.colorscheme].colorA;
-    data.colorB = colorscheme[data.colorscheme].colorB;
-  }
   data.widths = [
     (canvasContext.measureText(data.text[0]).width|0) + 10,
     (canvasContext.measureText(data.text[1]).width|0) + 10,
   ];
 
+  var template = templates[data.template + '-' + data.format];
   addEscapers(data);
   try {
     var result = template(data);
diff --git a/server.js b/server.js
index 234d0a8..f6c2699 100644
--- a/server.js
+++ b/server.js
@@ -2453,6 +2453,7 @@ function(data, match, end, ask) {
     }
     badge(badgeData, makeSend(format, ask.res, end));
   } catch(e) {
+    console.error(e.stack);
     badge({text: ['error', 'bad badge'], colorscheme: 'red'},
       makeSend(format, ask.res, end));
   }
diff --git a/templates/default-template.svg b/templates/default-template.svg
index a1c78f1..dcc8af4 100644
--- a/templates/default-template.svg
+++ b/templates/default-template.svg
@@ -5,9 +5,9 @@
     <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
     <stop offset="1"  stop-color="#000" stop-opacity=".5"/>
   </linearGradient>
-  <rect rx="4" width="{{=it.widths[0]+it.widths[1]}}" height="18" fill="{{=it.colorA||"#555"}}"/>
-  <rect rx="4" x="{{=it.widths[0]}}" width="{{=it.widths[1]}}" height="18" fill="{{=it.colorB||"#4c1"}}"/>
-  <rect x="{{=it.widths[0]}}" width="4" height="18" fill="{{=it.colorB||"#4c1"}}"/>
+  <rect rx="4" width="{{=it.widths[0]+it.widths[1]}}" height="18" fill="{{=it.escapeXml(it.colorA||"#555")}}"/>
+  <rect rx="4" x="{{=it.widths[0]}}" width="{{=it.widths[1]}}" height="18" fill="{{=it.escapeXml(it.colorB||"#4c1")}}"/>
+  <rect x="{{=it.widths[0]}}" width="4" height="18" fill="{{=it.escapeXml(it.colorB||"#4c1")}}"/>
   <rect rx="4" width="{{=it.widths[0]+it.widths[1]}}" height="18" fill="url(#smooth)"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="{{=it.widths[0]/2+1}}" y="14" fill="#010101" fill-opacity=".3">{{=it.escapeXml(it.text[0])}}</text>
diff --git a/templates/flat-square-template.svg b/templates/flat-square-template.svg
index eb46ea5..75fb021 100644
--- a/templates/flat-square-template.svg
+++ b/templates/flat-square-template.svg
@@ -1,7 +1,7 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="{{=it.widths[0]+it.widths[1]}}" height="20">
-  <rect width="{{=it.widths[0]+it.widths[1]}}" height="20" fill="{{=it.colorA||"#555"}}"/>
-  <rect x="{{=it.widths[0]}}" width="{{=it.widths[1]}}" height="20" fill="{{=it.colorB||"#4c1"}}"/>
-  <rect x="{{=it.widths[0]}}" width="4" height="20" fill="{{=it.colorB||"#4c1"}}"/>
+  <rect width="{{=it.widths[0]+it.widths[1]}}" height="20" fill="{{=it.escapeXml(it.colorA||"#555")}}"/>
+  <rect x="{{=it.widths[0]}}" width="{{=it.widths[1]}}" height="20" fill="{{=it.escapeXml(it.colorB||"#4c1")}}"/>
+  <rect x="{{=it.widths[0]}}" width="4" height="20" fill="{{=it.escapeXml(it.colorB||"#4c1")}}"/>
   <rect width="{{=it.widths[0]+it.widths[1]}}" height="20" fill-opacity=".1"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="{{=it.widths[0]/2+1}}" y="14">{{=it.escapeXml(it.text[0])}}</text>
diff --git a/templates/flat-template.svg b/templates/flat-template.svg
index 75ce224..8868bdd 100644
--- a/templates/flat-template.svg
+++ b/templates/flat-template.svg
@@ -3,9 +3,9 @@
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
   </linearGradient>
-  <rect rx="3" width="{{=it.widths[0]+it.widths[1]}}" height="20" fill="{{=it.colorA||"#555"}}"/>
-  <rect rx="3" x="{{=it.widths[0]}}" width="{{=it.widths[1]}}" height="20" fill="{{=it.colorB||"#4c1"}}"/>
-  <rect x="{{=it.widths[0]}}" width="4" height="20" fill="{{=it.colorB||"#4c1"}}"/>
+  <rect rx="3" width="{{=it.widths[0]+it.widths[1]}}" height="20" fill="{{=it.escapeXml(it.colorA||"#555")}}"/>
+  <rect rx="3" x="{{=it.widths[0]}}" width="{{=it.widths[1]}}" height="20" fill="{{=it.escapeXml(it.colorB||"#4c1")}}"/>
+  <rect x="{{=it.widths[0]}}" width="4" height="20" fill="{{=it.escapeXml(it.colorB||"#4c1")}}"/>
   <rect rx="3" width="{{=it.widths[0]+it.widths[1]}}" height="20" fill="url(#smooth)"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="{{=it.widths[0]/2+1}}" y="15" fill="#010101" fill-opacity=".3">{{=it.escapeXml(it.text[0])}}</text>