xss bug reported by Drew Callahan - View it on GitHub