HTML injection in API response including request url