XSS vulnerability may exist in Exception page

[Goyotan]

Hello developers of this cool software!

I found a problem that is the potential of XSS vulnerability.

function getMainMessage() in Unbound.php displays
exception details like exception exception\hoge with message deadbeef.

If result of $e->getMessage() contains user input and display it, It becomes vulnerable against XSS.
Because result of $e->getMessage() is passed to sprintf without escaping html characters.

Example of similar problem: https://hackerone.com/reports/216812

Thank you.

[koriym]

The html escape should be handled in the view side?