fix xss leak

Fix xss leak