![](/static/66c60d9f/assets/icons/icon-96x96.png)
![](https://programming.dev/pictrs/image/317c8257-44c2-4a1b-af00-4935affa25ed.webp)
If lenny-ui is already using a JSX based library (InfernoJS), why not use it? I can’t believe they construct HTML manually like that without a hint of escaping or stripping. Sure, many markdown renderers tell you to just slap it in __html or dangerouslySetInnerHtml but there are many that just parse the MD and let you render it with JSX!
I also can’t believe there’s no CSP that stopped this. Sure, it’s a pain in the ass to configure with a nonce but this is literally the kind of thing it’s made to block!
If the value is still passed as an environment variable in the end, it can be read via
/proc/:pid/environ
from another container or from the host if they are both using the same UID (or has--cap-add SYS_PTRACE
)