jsSandbox update - fix a JS injection