diff --git a/flow/src/org/labkey/flow/data/FlowObject.java b/flow/src/org/labkey/flow/data/FlowObject.java
index 3d85b357d7..1e48e70abf 100644
--- a/flow/src/org/labkey/flow/data/FlowObject.java
+++ b/flow/src/org/labkey/flow/data/FlowObject.java
@@ -61,6 +61,7 @@ public FlowObject(T expObject)
         _expObject = expObject;
     }
 
+    @Override
     public T getExpObject()
     {
         return _expObject;
diff --git a/flow/src/org/labkey/flow/view/setComment.jsp b/flow/src/org/labkey/flow/view/setComment.jsp
index 667b9bf0ca..a47b509c81 100644
--- a/flow/src/org/labkey/flow/view/setComment.jsp
+++ b/flow/src/org/labkey/flow/view/setComment.jsp
@@ -115,7 +115,7 @@ LABKEY.requiresExt3(function() {
                         'line-height': "18px",
                         display: "block",
                         visibility: "hidden",
-                        background: "transparent url(<%=contextPath%>/_.gif) no-repeat 0 2px"
+                        background: "transparent url(<%=h(contextPath)%>/_.gif) no-repeat 0 2px"
                     }
                 });
                 this.alignStatusIcon();
@@ -125,11 +125,11 @@ LABKEY.requiresExt3(function() {
             switch (status)
             {
                 case 'loading':
-                    this.statusEl.setStyle("background-image", "url(<%=contextPath%>/<%=PageFlowUtil.extJsRoot()%>/resources/images/default/grid/loading.gif)");
+                    this.statusEl.setStyle("background-image", "url(<%=h(contextPath)%>/<%=PageFlowUtil.extJsRoot()%>/resources/images/default/grid/loading.gif)");
                     this.statusEl.setStyle("color", "silver");
                     break;
                 case 'success':
-                    this.statusEl.setStyle("background-image", "url(<%=contextPath%>/<%=PageFlowUtil.extJsRoot()%>/resources/images/default/tree/drop-yes.gif)");
+                    this.statusEl.setStyle("background-image", "url(<%=h(contextPath)%>/<%=PageFlowUtil.extJsRoot()%>/resources/images/default/tree/drop-yes.gif)");
                     this.statusEl.setStyle("color", "green");
                     if (!this.delayHide)
                     {
@@ -138,7 +138,7 @@ LABKEY.requiresExt3(function() {
                     this.delayHide.delay(4000);
                     break;
                 case 'error':
-                    this.statusEl.setStyle("background-image", "url(<%=contextPath%>/<%=PageFlowUtil.extJsRoot()%>/resources/images/default/form/exclamation.gif)")
+                    this.statusEl.setStyle("background-image", "url(<%=h(contextPath)%>/<%=PageFlowUtil.extJsRoot()%>/resources/images/default/form/exclamation.gif)")
                     this.statusEl.setStyle("color", "red");
                     break;
             }
diff --git a/flow/src/org/labkey/flow/view/setGraphSize.jsp b/flow/src/org/labkey/flow/view/setGraphSize.jsp
index 8a82310fb9..1cbe9d5190 100644
--- a/flow/src/org/labkey/flow/view/setGraphSize.jsp
+++ b/flow/src/org/labkey/flow/view/setGraphSize.jsp
@@ -142,7 +142,7 @@
 <%
 for (Map.Entry<String, String> entry : sizes.entrySet()) { %>
     <div class="labkey-graph-size">
-        [<a class="<%=entry.getKey().equals(graphSize) ? "labkey-selected-link" : ""%>" name="graphSize<%=entry.getKey()%>" onclick="setGraphSize(<%=entry.getKey()%>)"><%=h(entry.getValue())%></a>]
+        [<a class="<%=h(entry.getKey().equals(graphSize) ? "labkey-selected-link" : "")%>" name="graphSize<%=h(entry.getKey())%>" onclick="setGraphSize(<%=h(entry.getKey())%>)"><%=h(entry.getValue())%></a>]
     </div>
 <% } %>
 <img id="updateGraphSize" height="1" width="1" src="<%=getWebappURL("_.gif")%>">