aligned with clean_xss_fix branch