Fix for href exploit introduced in #3826

Fix for href exploit introduced in #3826