fix(security): theme selection via dom input without validation (#629)

The `changeCSS` function constructs a URL by interpolating user-controlled input (`theme` parameter from the `<select>` element) directly into a CDN URL template. While the current `<select>` restricts values, if the function were called programmatically (e.g., via browser console or if the DOM is manipulated), an attacker could inject an arbitrary path into the stylesheet URL, potentially loading a malicious CSS file from the CDN.

Affected files: index.html

Signed-off-by: Trần Bách <45133811+barttran2k@users.noreply.github.com>

index.html

@@ -58,8 +58,11 @@
 			.catch( error => console.error( 'Error:', error ) );
 
 		// Change the theme
+		const allowedThemes = ['darkly', 'united', 'flatly', 'quartz'];
+
 		function changeCSS( theme )
 		{
+			if ( !allowedThemes.includes( theme ) ) return;
 			document.querySelector( 'link' ).href
 					= `https://cdn.jsdelivr.net/npm/bootswatch@${bootswatchVersion}/dist/${theme}/bootstrap.min.css`;
 		}