Escapes return value of toString() plus adds missing toString() implementations

core/src/main/java/org/apache/struts2/dispatcher/Parameter.java

@@ -1,5 +1,6 @@
 package org.apache.struts2.dispatcher;
 
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
@@ -85,14 +86,22 @@ public interface Parameter {
 
         @Override
         public String toString() {
-            return getValue();
+            return StringEscapeUtils.escapeHtml4(getValue());
         }
     }
 
     class File extends Request {
+
         public File(String name, Object value) {
             super(name, value);
         }
+
+        @Override
+        public String toString() {
+            return "File{" +
+                    "name='" + getName() + '\'' +
+                    '}';
+        }
     }
 
     class Empty implements Parameter {
@@ -132,6 +141,13 @@ public interface Parameter {
         public Object getObject() {
             return null;
         }
+
+        @Override
+        public String toString() {
+            return "Empty{" +
+                    "name='" + name + '\'' +
+                    '}';
+        }
     }
 
 }