XSS vulnerabilities due to missing checks in tag helpers