fix xss leak