XSS matches a bit too forceful (data:)