fix part_pkg.comment xss