fix js injection