JavaScript XSS fixed