commit xss fix