This feels like a candidate for a xss