xss risk from safe filter fixed