The submitted tests in the patch for the XSS fix is not right. To test, it should test "what should happen", but not "what doesn't exist" or "what is processed/decoded".