lib/httpserver: escape the error string before sending it in the response to the client

See https://github.com/VictoriaMetrics/VictoriaMetrics/security/code-scanning/353

lib/httpserver/httpserver.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"html"
 	"io"
 	"log"
 	"net"
@@ -670,7 +671,11 @@ func Errorf(w http.ResponseWriter, r *http.Request, format string, args ...any)
 	if rwa, ok := w.(*responseWriterWithAbort); ok && rwa.sentHeaders {
 		// HTTP status code has been already sent to client, so it cannot be sent again.
 		// Just write errStr to the response and abort the client connection, so the client could notice the error.
-		fmt.Fprintf(w, "\n%s\n", errStr)
+		//
+		// HTML-escape the errStr in order to protect from possible XSS, since the errStr may contain user input.
+		errStrEscaped := html.EscapeString(errStr)
+
+		fmt.Fprintf(w, "\n%s\n", errStrEscaped)
 		rwa.abort()
 		return
 	}