Fix potential XSS

https://hackerone.com/reports/6843