There were two very simple Google Glass Mirror's quickstart DOS and XSS vulnerabilities. The fixes have been introduced in changeset https://github.com/googleglass/mirror-quickstart-java/commit/738352eb5b5b73aa7bb911d0aeee3386f40dbf26
The DOS fix is rather simple. Limit the request to 1000 lines. The XSS fix is hackish but works. Instead of reflecting the client's input back to the user, the error is directed to the error logging infrastructure. Let's hope the error logging infrastructure is anti-XSS enabled.