Bug get url xss