Fix various XSS issues (CVE-2013-5772).

http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/85226f84bc29 contains the
fixes which I've backported here.