diff --git a/commons/src/main/java/com/composum/sling/core/util/SlingUrl.java b/commons/src/main/java/com/composum/sling/core/util/SlingUrl.java
index <HASH>..<HASH> 100644
--- a/commons/src/main/java/com/composum/sling/core/util/SlingUrl.java
+++ b/commons/src/main/java/com/composum/sling/core/util/SlingUrl.java
@@ -1178,7 +1178,7 @@ public class SlingUrl implements Cloneable {
                 builder.append('#').append(UrlCodec.FRAGMENT.encode(fragment));
             }
         }
-        return XSS.getValidHref(builder.toString());
+        return builder.toString();
     }
 
     protected void parseUrl(@Nonnull final String url, final boolean decode) throws IllegalArgumentException {
no additional XSS filtering in URL construction