fix xss issue in blame