From ce400441c404cdae526a4968141424d8a241f964 Mon Sep 17 00:00:00 2001 From: Sean Morley Date: Thu, 23 Jul 2026 18:12:06 -0400 Subject: [PATCH] Enhance theme handling in hooks.server.ts by introducing a set of allowed theme names and updating theme resolution logic to validate against this set. --- frontend/src/hooks.server.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/frontend/src/hooks.server.ts b/frontend/src/hooks.server.ts index 7c037d78..3837a7d9 100644 --- a/frontend/src/hooks.server.ts +++ b/frontend/src/hooks.server.ts @@ -1,6 +1,9 @@ import type { Handle } from '@sveltejs/kit'; import { sequence } from '@sveltejs/kit/hooks'; +import { themes } from '$lib'; + const PUBLIC_SERVER_URL = process.env['PUBLIC_SERVER_URL']; +const ALLOWED_THEME_NAMES = new Set(themes.map((theme) => theme.name)); export const authHook: Handle = async ({ event, resolve }) => { event.cookies.delete('csrftoken', { path: '/' }); @@ -88,7 +91,8 @@ export const authHook: Handle = async ({ event, resolve }) => { }; export const themeHook: Handle = async ({ event, resolve }) => { - let theme = event.url.searchParams.get('theme') || event.cookies.get('colortheme'); + const candidate = event.url.searchParams.get('theme') || event.cookies.get('colortheme'); + const theme = candidate && ALLOWED_THEME_NAMES.has(candidate) ? candidate : null; if (theme) { return await resolve(event, {