[Bug 840442] fix all XSS vulnerabilities [r=crdlc]