DOM-based XSS via Safe Server Side Inclusion