Handle portlet error messages properly (#15398)

Change-Id: Ie7936fd2eaca0e0c5da1f6ed8f12238ae207b7eb

1 files changed, 5 insertions, 0 deletions

diff --git a/server/src/com/vaadin/server/VaadinPortletResponse.java b/server/src/com/vaadin/server/VaadinPortletResponse.java
index 7a0a68d116..d9f133ac8a 100644
--- a/server/src/com/vaadin/server/VaadinPortletResponse.java
+++ b/server/src/com/vaadin/server/VaadinPortletResponse.java
@@ -30,6 +30,8 @@ import javax.portlet.PortletResponse;
 import javax.portlet.ResourceResponse;
 import javax.servlet.http.Cookie;
 
+import com.google.gwt.thirdparty.guava.common.html.HtmlEscapers;
+
 /**
  * Wrapper for {@link PortletResponse} and its subclasses.
  * 
@@ -128,6 +130,9 @@ public class VaadinPortletResponse implements VaadinResponse {
     @Override
     public void sendError(int errorCode, String message) throws IOException {
         setStatus(errorCode);
+        if (message != null) {
+            message = HtmlEscapers.htmlEscaper().escape(message);
+        }
         getWriter().write(message);
     }