Web UI inputs evaluate HTML and JavaScript content (Cross-Site Scripting vulnerability)

Scripts or HTML content in request fields get evaluated.

Put something like this in a text field:

```js
<script>alert('boom')</script>
```

and the script will be evaluated on focus changes.

HTML content like `<h1>Test</h1>` will be rendered in "Raw Request" tab.