Fix XSS in data-object-label

data-object-label was not being escaped.