add white list for xss