fix XSS vulnerability in console log #338