Fix xss vulnerability