Solved issue with unsafe img url injection