Comment 2 for bug 978439

Confirmed that it looks like a user-provided invalid instance ID would be put as-is in the XML response message, and that should probably be filtered.

Not sure there is an security attack vector there though. Looks like you would just reap what you sow yourself ?
Joshua: could you explain how this could be bad, so that we set importance right ?