Summary

Fix an xss vulnerability that was fed via email.

Fix #1477 (comment)

What kind of change does this PR introduce?

For any code change,

• Related documentation has been updated if needed
• Related tests have been updated or tests have been added

Does this PR introduce a breaking change? (check one)

• Yes
• No

If yes, please describe the impact and migration path for existing applications:

Related issue, if any:

Tested in the following browsers:

• Chrome
• Firefox
• Safari
• Edge
• IE