[bug] fix the vulnerbility of XSS attack