fix xss in search module