Fix potential XSS issue with arbitrary JS or HTML