fix blob parsing vulnerability by using blob_parse_untrusted