Fix XSS injection via term list import