fixed xss attack vector on uuid.