“Uncaught exception” page contains HTML but has content-type text/plain

Thanks for the patch, it's short and works well for fixing described problem! Why it is obvious fix and not right? Does it broke some other places?

Here is the patch based on #8

Only one fail now, but I think the test testBacktraceEscaping should change because of these two lines :

$request->setFormat('html', ['text/html']);
$this->assertEqual($response->headers->get('Content-type'), 'text/plain; charset=UTF-8');

Ok, so I just have to change the test in my patch ?
Here's the patch with the ExceptionHandlingTest.php fixed

Oh yeah, I forgot about the testExceptionEscaping method.
This should be better now

Thank you for the huge help @AdamPS

+++ b/core/lib/Drupal/Core/EventSubscriber/FinalExceptionSubscriber.php
@@ -123,9 +123,10 @@ public function onException(GetResponseForExceptionEvent $event) {
+    $content_type = $event->getRequest()->getRequestFormat() == 'html' ? 'text/html' : 'text/plain';
     $content = $this->t('The website encountered an unexpected error. Please try again later.');
     $content .= $message ? '</br></br>' . $message : '';
-    $response = new Response($content, 500, ['Content-Type' => 'text/plain']);
+    $response = new Response($content, 500, ['Content-Type' => $content_type]);

An alternate fix and one that keeps the page text plain is to change the <br> tags to "\n\n". HTML in the exception message is already escaped so this is the only HTML on the page. I prefer this fix because in a way text/plain is defence in depth if auto-escaping the exception messages breaks for some reason.

@AdamPS hmmm good point. I think my fear about not escaping exception messages is irrational. The message is constructed one of two ways
$message = new FormattableMarkup('%type: @message in %function (line %line of %file).', $error);
or
$message = new FormattableMarkup('%type: @message in %function (line %line of %file). <pre class="backtrace">@backtrace</pre>', $error);
In both instances there's nothing from $error that is not escaped and if FormattableMarkup we have bigger problems. Plus escaping on exceptions is tested in \Drupal\KernelTests\Core\Routing\ExceptionHandlingTest::testExceptionEscaping and \Drupal\KernelTests\Core\Routing\ExceptionHandlingTest::testBacktraceEscaping so that's good.

I've pondered if we should consider running $content through \Drupal\Component\Render\PlainTextOutput::renderFromHtml() when outputting text/plain but that runs the risk of unescaping things so let's not to that here.

Even though this is a bug fix I'm going to commit to 8.8.x just in case any of my assumptions about security prove incorrect. I'm very sure that there's no harm in making this change but as a minor fix there's no rush either.

Committed c7bfe49 and pushed to 8.8.x. Thanks!