commit with XSS issue