viperutil: Remove potential cross site reflecting issue (#13483)

It's possible to inject HTML / Javascript in the format parameter which
means you can do a self XSS. Not a huge immediately issue as it's only
self XSS, but we should fix it nonetheless.

Signed-off-by: Dirkjan Bussink <[email protected]>

go/viperutil/debug/handler.go

@@ -77,6 +77,6 @@ func HandlerFunc(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	default:
-		http.Error(w, fmt.Sprintf("unsupported config format %s", format), http.StatusBadRequest)
+		http.Error(w, "unsupported config format", http.StatusBadRequest)
 	}
 }