vendor/nelmio/security-bundle/EventListener/XssProtectionListener.php
line 39
Open in your IDE?