text xss on github