[Security] fix raw XSS vunerability