Broken Link when using semicolon in the URL in Resin application server

We use Resin 4.0.48 application server and his implementation of Servlet API make Spring Hateoas ( 0.23.0) Links broken. Here an example
We've got bellow controller, which builds Link to himself.

@RestController
public class SemicolonBreakableController {
    @RequestMapping(path = "/blabla/9999/sort/{sortKey}", method = RequestMethod.GET)
    @ResponseBody
    public Link blablaFragment(@PathVariable("sortKey") String sortKey) {
        ControllerLinkBuilder linkBuilder = linkTo(
                methodOn(SemicolonBreakableController.class).blablaFragment("default"));
        return linkBuilder.withSelfRel();
    }
}

Now we've got following request with kinda HTML atack: http://localhost:8080/blabla/9999/sort/'style='font-size:100pxbackground:%23ccc'onmouseover=alert`xss`>XSS!<x

Actually we want that we get bellow JSON, because we set always sortKey to "default"

{"rel":"self","href":"http://localhost:8080/blabla/9999/sort/default"}

But we get something like this:

{"rel":"self","href":"http://localhost:8080/blabla/9999/sort/'style='font-size:100px;background:#ccc'onmouseover=alert`xss`>XSS!<x/blabla/9999/start/0/sort/default"}

So the part /blabla/9999/sort/ is somehow twice.

I think the problem is in the method UrlPathHelper.getPathWithinServletMapping, where you get

String pathWithinApp = getPathWithinApplication(request);
String servletPath = getServletPath(request);

during the debugging I saw the value of these variables were:

pathWithinApp = "/blabla/9999/sort/'style='font-size:100px"
servletPath = "/blabla/9999/sort/'style='font-size:100px;background:#ccc'onmouseover=alert`xss`>;XSS!<x"

Start with the reported UrlPathHelper.getPathWithinServletMapping entry point and inspect how getPathWithinApplication(request) and getServletPath(request) are combined. Reproduce the semicolon-containing request against Resin 4.0.48, then trace link generation from the controller example. Done means the self link matches the expected /blabla/9999/sort/default URL without duplicating the request path.