CSS Injection

Codimd seems to support custom CSS. This opens the door to adding malicious CSS payloads. On the harmless end, this would be an example:

```css
body { opacity: 0; }
```

Do server admins currently have the ability to disable custom CSS?

In cases where the feature is enabled, I suggest you employ a sandboxing approach; moving the displayed markdown to inside an iframe and leaving this issue open to track the implications of custom CSS and develop novel sandboxing ideas.