fix xss security bug in highlighter function