even if createObjectURL should return safe URL, better be safe than sorry, please escape the value using `Utils.escapeHTML`