[galaxy-dev] Galaxy prone to XSS and HTML injection attacks