Bug 883616 - Bug 882607 resolution introduced a XSS vulnerability

Carefully escape the body before injecting it into the document