From 488c90d7b89770653f0bbcfa412ab98d2e30df41 Mon Sep 17 00:00:00 2001
From: Zul <codinglombok@gmail.com>
Date: Sat, 18 Jul 2026 15:49:52 +0800
Subject: [PATCH] Potential fix for code scanning alert no. 4: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 docs/assets/docs.js | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/docs/assets/docs.js b/docs/assets/docs.js
index c08b121..1eba8cb 100644
--- a/docs/assets/docs.js
+++ b/docs/assets/docs.js
@@ -2,9 +2,30 @@
 (function(){
   var root = document.documentElement;
   var q = new URLSearchParams(location.search);
-  var style = q.get('style') || 'modern-corporate-flat';
-  var theme = q.get('theme') || 'light';
-  var dir   = q.get('dir')   || 'ltr';
+
+  function sanitizeStyle(value){
+    var allowed = ['modern-corporate-flat', 'modern-corporate-neumorph'];
+    return allowed.indexOf(value) !== -1 ? value : 'modern-corporate-flat';
+  }
+
+  function sanitizeTheme(value){
+    return value === 'dark' ? 'dark' : 'light';
+  }
+
+  function sanitizeDir(value){
+    return value === 'rtl' ? 'rtl' : 'ltr';
+  }
+
+  function sanitizeDataPage(value){
+    if (!value) return null;
+    if (/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(value)) return null;
+    if (!/^[a-zA-Z0-9._\-\/]+\.html(?:#[a-zA-Z0-9_\-]+)?$/.test(value)) return null;
+    return value;
+  }
+
+  var style = sanitizeStyle(q.get('style'));
+  var theme = sanitizeTheme(q.get('theme'));
+  var dir   = sanitizeDir(q.get('dir'));
   apply();
   function apply(){
     root.setAttribute('data-style', style);
@@ -17,13 +38,14 @@
     var dk=document.getElementById('dk'); if(dk) dk.checked = theme==='dark';
     var rt=document.getElementById('rt'); if(rt) rt.checked = dir==='rtl';
     // rewrite internal nav links to carry state
-    var qs='?style='+style+'&theme='+theme+'&dir='+dir;
+    var qs='?' + new URLSearchParams({ style: style, theme: theme, dir: dir }).toString();
     document.querySelectorAll('a[data-page]').forEach(function(a){
-      a.setAttribute('href', a.getAttribute('data-page')+qs);
+      var dataPage = sanitizeDataPage(a.getAttribute('data-page'));
+      if (dataPage) a.setAttribute('href', dataPage + qs);
     });
   }
   document.querySelectorAll('[data-style-set]').forEach(function(b){
-    b.addEventListener('click', function(){ style=b.getAttribute('data-style-set'); apply(); });
+    b.addEventListener('click', function(){ style=sanitizeStyle(b.getAttribute('data-style-set')); apply(); });
   });
   var dk=document.getElementById('dk'); if(dk) dk.addEventListener('change',function(e){ theme=e.target.checked?'dark':'light'; apply(); });
   var rt=document.getElementById('rt'); if(rt) rt.addEventListener('change',function(e){ dir=e.target.checked?'rtl':'ltr'; apply(); });