fix XSS in jUI menu rendering