hotfix defence xss injection at markdwon parser