Backporting xss fix