LPD-56406 Escape Parameter URL in RenderStructureFieldMVCResourceCommand

Author: mxs2

modules/apps/dynamic-data-mapping/dynamic-data-mapping-web/src/main/java/com/liferay/dynamic/data/mapping/web/internal/portlet/action/RenderStructureFieldMVCResourceCommand.java

@@ -124,8 +124,8 @@ protected void doServeResource(
 	private DDMFormField _getDDMFormField(
 		HttpServletRequest httpServletRequest) {
 
-		String definition = ParamUtil.getString(
-			httpServletRequest, "definition");
+		String definition = HtmlUtil.escapeAttribute(
+			ParamUtil.getString(httpServletRequest, "definition"));
 		String fieldName = ParamUtil.getString(httpServletRequest, "fieldName");
 
 		DDMFormDeserializerDeserializeRequest.Builder builder =