object_Object@programming.devtoProgramming.dev Meta@programming.dev•FYI: Lemmy.world and other instances were hacked. Beehaw.org took itself down to mitigate risksEnglish
2·
1 year agoIf lenny-ui is already using a JSX based library (InfernoJS), why not use it? I can’t believe they construct HTML manually like that without a hint of escaping or stripping. Sure, many markdown renderers tell you to just slap it in __html or dangerouslySetInnerHtml but there are many that just parse the MD and let you render it with JSX!
I also can’t believe there’s no CSP that stopped this. Sure, it’s a pain in the ass to configure with a nonce but this is literally the kind of thing it’s made to block!
show
EXPLAIN
for the query, maybe alsoEXPLAIN (ANALYZE, BUFFERS)
with sayLIMIT 1000
so that it finishes some day