Group save error message with escaped html

Author: subash-natarajan

app/code/Magento/Customer/Controller/Adminhtml/Group/Save.php

@@ -20,6 +20,11 @@ class Save extends \Magento\Customer\Controller\Adminhtml\Group implements HttpP
      */
     protected $dataObjectProcessor;
 
+    /**
+     * @var \Magento\Framework\Escaper
+     */
+    protected $escaper;
+
     /**
      *
      * @param \Magento\Backend\App\Action\Context $context
@@ -29,6 +34,7 @@ class Save extends \Magento\Customer\Controller\Adminhtml\Group implements HttpP
      * @param \Magento\Backend\Model\View\Result\ForwardFactory $resultForwardFactory
      * @param \Magento\Framework\View\Result\PageFactory $resultPageFactory
      * @param \Magento\Framework\Reflection\DataObjectProcessor $dataObjectProcessor
+     * @param \Magento\Framework\Escaper $escaper
      */
     public function __construct(
         \Magento\Backend\App\Action\Context $context,
@@ -37,9 +43,11 @@ public function __construct(
         GroupInterfaceFactory $groupDataFactory,
         \Magento\Backend\Model\View\Result\ForwardFactory $resultForwardFactory,
         \Magento\Framework\View\Result\PageFactory $resultPageFactory,
-        \Magento\Framework\Reflection\DataObjectProcessor $dataObjectProcessor
+        \Magento\Framework\Reflection\DataObjectProcessor $dataObjectProcessor,
+        \Magento\Framework\Escaper $escaper
     ) {
         $this->dataObjectProcessor = $dataObjectProcessor;
+        $this->escaper = $escaper;
         parent::__construct(
             $context,
             $coreRegistry,
@@ -96,7 +104,7 @@ public function execute()
                 $this->messageManager->addSuccessMessage(__('You saved the customer group.'));
                 $resultRedirect->setPath('customer/group');
             } catch (\Exception $e) {
-                $this->messageManager->addErrorMessage($e->getMessage());
+                $this->messageManager->addErrorMessage($this->escaper->escapeHtml($e->getMessage()));
                 if ($customerGroup != null) {
                     $this->storeCustomerGroupDataToSession(
                         $this->dataObjectProcessor->buildOutputDataArray(

app/code/Magento/Customer/Test/Unit/Controller/Adminhtml/Group/SaveTest.php

@@ -87,6 +87,10 @@ protected function setUp()
         $this->dataObjectProcessorMock = $this->getMockBuilder(DataObjectProcessor::class)
             ->disableOriginalConstructor()
             ->getMock();
+        $this->escaper = $this->getMockBuilder(\Magento\Framework\Escaper::class)
+            ->disableOriginalConstructor()
+            ->setMethods(['escapeHtml'])
+            ->getMock();
         $this->request = $this->getMockBuilder(\Magento\Framework\App\RequestInterface::class)
             ->getMockForAbstractClass();
         $this->resultRedirectFactory = $this->getMockBuilder(RedirectFactory::class)
@@ -129,7 +133,8 @@ protected function setUp()
             $this->groupInterfaceFactoryMock,
             $this->forwardFactoryMock,
             $this->pageFactoryMock,
-            $this->dataObjectProcessorMock
+            $this->dataObjectProcessorMock,
+            $this->escaper
         );
     }