Fix XSS in pub errors

See https://hackerone.com/reports/8955