Escape source_name parameter on RDoc::Servlet.

  Patch by @claudijd

Author: hsbt

lib/rdoc/servlet.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 require 'rdoc'
+require 'erb'
 require 'time'
 require 'json'
 require 'webrick'
@@ -427,14 +428,14 @@ def store_for source_name
       end
 
       raise WEBrick::HTTPStatus::NotFound,
-            "Could not find gem \"#{source_name}\". Are you sure you installed it?" unless ri_dir
+            "Could not find gem \"#{ERB::Util.html_escape(source_name)}\". Are you sure you installed it?" unless ri_dir
 
       store = RDoc::Store.new ri_dir, type
 
       return store if File.exist? store.cache_path
 
       raise WEBrick::HTTPStatus::NotFound,
-            "Could not find documentation for \"#{source_name}\". Please run `gem rdoc --ri gem_name`"
+            "Could not find documentation for \"#{ERB::Util.html_escape(source_name)}\". Please run `gem rdoc --ri gem_name`"
 
     end
   end