Proxy error messages crossite scripting

In error message URL is not escaped, it makes it possible to inject javascript into URL...