[SECURITY] Prevent XSS in EXT:form error message output

Resolves: #88629
Releases: master, 9.5, 8.7
Security-Commit: e179b6dd34bb47f2af28c58c19a14f46ae8f9f52
Security-Bulletin: TYPO3-CORE-SA-2019-021
Change-Id: Ifd513f543f9be44285322136f89992c00be0fbcd
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/62709
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

typo3/sysext/form/Resources/Private/Frontend/Partials/Field/Field.html

@@ -10,7 +10,7 @@
                 <f:if condition="{validationResults.flattenedErrors}">
                     <span class="error help-block" role="alert">
                         <f:for each="{validationResults.errors}" as="error">
-                            {formvh:translateElementError(element: element, error: error)}
+                            <f:format.htmlspecialchars>{formvh:translateElementError(element: element, error: error)}</f:format.htmlspecialchars>
                             <br />
                         </f:for>
                     </span>