Fix CWE-79: HTML-escape redirect URL written to response body for non-302 status codes

[arunmanni-ai]

Summary

ServletRedirectResult.sendRedirect() writes the redirect target URL
directly to the response body for any statusCode != 302 (e.g. 301, 303,
307, 308, or misconfigured 200), without HTML encoding. Since the servlet
container defaults Content-Type to text/html, this is a reflected XSS
sink when user-controlled content reaches finalLocation via OGNL
expression evaluation (parse=true, the default).

PostbackResult.java (line 108) in the same package already uses
StringEscapeUtils.escapeHtml4() for the identical pattern — this aligns
ServletRedirectResult with the existing convention.

Changes

• HTML-escape finalLocation before writing to response body in sendRedirect()
• Location header is intentionally left unescaped (required for valid redirect)
• New test verifies <script> payload is escaped in body while Location header keeps raw URL

References

• CWE-79: Improper Neutralization of Input During Web Page Generation
• Comparable fix: PostbackResult.java line 108 (same codebase)

[arunmanni-ai]

JIRA ticket: https://issues.apache.org/jira/browse/WW-5636