RM page should throw exception when command injected in RM REST API to get applications

Using a web application attacking, we see that injecting commands like ACCEPTED, FAILED and FINISHED to RM REST API does not throw an exception. Refer images.