Close XSS in button#setText

Similar to #254.