Fix XSS vulnerabilities in manual rules