If lenny-ui is already using a JSX based library (InfernoJS), why not use it? I can’t believe they construct HTML manually like that without a hint of escaping or stripping. Sure, many markdown renderers tell you to just slap it in __html or dangerouslySetInnerHtml but there are many that just parse the MD and let you render it with JSX!

I also can’t believe there’s no CSP that stopped this. Sure, it’s a pain in the ass to configure with a nonce but this is literally the kind of thing it’s made to block!

I somehow feel like there’s an allergy of sort towards classes in general in JavaScript/TypeScript. Many projects I’ve worked on gravitate towards more functional/plain-old-objects sort of paradigm and it feels like classes are avoided just because they don’t feel like idiomatic JS.