cherry-pick 1a1e46f  IDEA-105372 HTML injection into application messages