fix cross domain confict & xss

fix multiple cross domain file conflict
& xss attack by `javascript:`