diff --git a/framework/framework/server.ts b/framework/framework/server.ts
index 70a9e19f1..b465f0a6a 100644
--- a/framework/framework/server.ts
+++ b/framework/framework/server.ts
@@ -712,14 +712,13 @@ ${c.response.status} ${endTime - startTime}ms ${c.response.length}`);
         this.ctx.on(`handler/register/${name}`, callback as any);
     }
 
-    // FIXME: should be typeof Handler<Context> instead of any
     // eslint-disable-next-line @typescript-eslint/naming-convention
-    public Route(name: string, path: string, RouteHandler: any, ...permPrivChecker) {
+    public Route(name: string, path: string, RouteHandler: typeof Handler<C>, ...permPrivChecker) {
         return this.register('route', name, path, RouteHandler, ...permPrivChecker);
     }
 
     // eslint-disable-next-line @typescript-eslint/naming-convention
-    public Connection(name: string, path: string, RouteHandler: any, ...permPrivChecker) {
+    public Connection(name: string, path: string, RouteHandler: typeof ConnectionHandler<C>, ...permPrivChecker) {
         return this.register('conn', name, path, RouteHandler, ...permPrivChecker);
     }
 
diff --git a/packages/hydrooj/src/settings.ts b/packages/hydrooj/src/settings.ts
index d55f67b53..4a9aae124 100644
--- a/packages/hydrooj/src/settings.ts
+++ b/packages/hydrooj/src/settings.ts
@@ -40,12 +40,12 @@ export class ConfigService extends Service {
 
     applyDelta(source: any, key: string, value: any) {
         const path = key.split('.');
-        if (path.filter((i) => ['__proto__', 'prototype'].includes(i)).length) return false;
+        if (path.filter((i) => ['__proto__', 'prototype', 'constructor'].includes(i)).length) return false;
         const t = path.pop();
         const root = JSON.parse(JSON.stringify(source));
         let cursor = root;
         for (const p of path) {
-            cursor[p] ||= {};
+            cursor[p] ??= {};
             cursor = cursor[p];
         }
         cursor[t] = value;
diff --git a/packages/ui-default/pages/setting.page.tsx b/packages/ui-default/pages/setting.page.tsx
index 7d479f3b7..e90f2354c 100644
--- a/packages/ui-default/pages/setting.page.tsx
+++ b/packages/ui-default/pages/setting.page.tsx
@@ -25,13 +25,14 @@ const page = new NamedPage('manage_config', async () => {
   const { monaco, registerAction, renderMarkdown } = await load(['yaml']);
   const KForm = applyVueInReact(form.Form) as any;
 
-  function MarkdownContainer(props) {
+  function MarkdownContainer({ source }) {
     const rendered = React.useMemo(() => {
-      const res = renderMarkdown({ value: props.source });
+      const res = renderMarkdown({ value: source });
       const value = res.element.innerHTML;
       res.dispose();
       return value;
-    }, [props.source]);
+    }, [source]);
+    // Markdown snippet come from trusted backend code, no need to sanitize here
     return <div dangerouslySetInnerHTML={{ __html: rendered }} />;
   }
   const [, ReactMissVue] = createReactMissVue({
@@ -62,8 +63,8 @@ const page = new NamedPage('manage_config', async () => {
         if (!editor) return;
         editor.layout();
       };
-      document.addEventListener('resize', listener);
-      return () => document.removeEventListener('resize', listener);
+      window.addEventListener('resize', listener);
+      return () => window.removeEventListener('resize', listener);
     }, [editor]);
     React.useEffect(() => {
       if (!editorRef.current || loading) return;
diff --git a/packages/ui-next/index.ts b/packages/ui-next/index.ts
index 0ee6d2f72..1e0b64aeb 100644
--- a/packages/ui-next/index.ts
+++ b/packages/ui-next/index.ts
@@ -3,12 +3,10 @@ import importMetaUrlPlugin from '@codingame/esbuild-import-meta-url-plugin';
 import react from '@vitejs/plugin-react-swc';
 import c2k from 'koa2-connect';
 import _ from 'lodash';
+import fs from 'fs';
 import { createServer } from 'vite';
 import { } from '@hydrooj/framework';
-import {
-    BadRequestError, Context, db, DocumentModel, Handler, ObjectId, param, ProblemModel, RecordModel, SettingModel,
-    StorageModel,
-} from 'hydrooj';
+import { Context } from 'hydrooj';
 
 export async function apply(ctx: Context) {
     if (process.env.HYDRO_CLI) return;
@@ -45,8 +43,7 @@ export async function apply(ctx: Context) {
     for (const route of capture) {
         ctx.server.addCaptureRoute(route, middleware);
     }
-    const html = require('fs').readFileSync(path.join(__dirname, 'index.html'), 'utf-8');
-    console.log(html);
+    const html = fs.readFileSync(path.join(__dirname, 'index.html'), 'utf-8');
     ctx.server.registerRenderer('next', {
         name: 'next',
         accept: ['main.html'],