xss vulnerability

Merged Piotr Gawron requested to merge 276-xss-vulnerability into master

Closes #274

Merge request reports