LPS-31883 fix XSS