XSS in site search action

http://confluence.atlassian.com/dosearchsite.action?where=conf_all&queryString=%3Cscript%3Ealert('foo');%3C/script%3E

queryString needs to be escaped.

This problem is fixed if they turn on Anti-XSS mode. We still need to fix this as anti-xss is not on by default.