Both WhoisAction and WhoisHttpAction set the HTTP response content type to "text/plain". There is no need to defensively escape the content. In fact, by escaping the content, it creates more problems down the line.
When used in a website, the response should be written into a DOM node by setting the textContent of the node, which automatically escapes the content.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=196743398
7388958df7