[CB-4203] need to avoid script injection