JS Injection Fix PR

Fixes a bug that would allow for javascript injection into the editor. Improves on a previous solution.

/cc @koke , @SergioEstevao