[misc] Fixed potential XSS