fixed bug with untrusted source