LPS-35182 XSS in portletResource inside plugins