fix XSS for iOS