Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk: Remove all...

Issue #2560641 by alexpott, lauriii, Xano, borisson_, ianthomas_uk: Remove all usages SafeMarkup::checkPlain() from render arrays

core/includes/theme.inc

@@ -20,6 +20,7 @@
 use Drupal\Core\Theme\ThemeSettings;
 use Drupal\Component\Utility\NestedArray;
 use Drupal\Core\Render\Element;
+use Drupal\Core\Render\SafeString;
 
 /**
  * @defgroup content_flags Content markers
@@ -1241,7 +1242,8 @@ function template_preprocess_html(&$variables) {
   }
   if (!empty($variables['page']['#title'])) {
     $head_title = array(
-      'title' => trim(strip_tags($variables['page']['#title'])),
+      // Marking the title as safe since it has had the tags stripped.
+      'title' => SafeString::create(trim(strip_tags($variables['page']['#title']))),
       'name' => $site_config->get('name'),
     );
   }

core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/BasicStringFormatter.php

@@ -7,7 +7,7 @@
 
 namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
 
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
 use Drupal\Core\Field\FormatterBase;
 use Drupal\Core\Field\FieldItemListInterface;
 
@@ -37,7 +37,7 @@ public function viewElements(FieldItemListInterface $items) {
     foreach ($items as $delta => $item) {
       // The text value has no text format assigned to it, so the user input
       // should equal the output, including newlines.
-      $elements[$delta] = array('#markup' => nl2br(SafeMarkup::checkPlain($item->value)));
+      $elements[$delta] = array('#markup' => nl2br(Html::escape($item->value)));
     }
 
     return $elements;

core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/LanguageFormatter.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Entity\EntityManagerInterface;
 use Drupal\Core\Field\FieldDefinitionInterface;
 use Drupal\Core\Field\FieldItemInterface;
@@ -123,7 +122,9 @@ protected function viewValue(FieldItemInterface $item) {
     // storage by LanguageManager::getLanguages()) or in its native language
     // name. That only depends on formatter settings and no language condition.
     $languages = $this->getSetting('native_language') ? $this->languageManager->getNativeLanguages(LanguageInterface::STATE_ALL) : $this->languageManager->getLanguages(LanguageInterface::STATE_ALL);
-    return $item->language && isset($languages[$item->language->getId()]) ? SafeMarkup::checkPlain($languages[$item->language->getId()]->getName()) : '';
+    return [
+      '#plain_text' => $item->language && isset($languages[$item->language->getId()]) ? $languages[$item->language->getId()]->getName() : ''
+    ];
   }
 
 }

core/lib/Drupal/Core/Field/Plugin/Field/FieldFormatter/StringFormatter.php

@@ -7,7 +7,7 @@
 
 namespace Drupal\Core\Field\Plugin\Field\FieldFormatter;
 
-use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\Html;
 use Drupal\Core\Entity\EntityManagerInterface;
 use Drupal\Core\Entity\RevisionableInterface;
 use Drupal\Core\Field\FieldDefinitionInterface;
@@ -128,16 +128,16 @@ public function viewElements(FieldItemListInterface $items) {
     }
 
     foreach ($items as $delta => $item) {
-      $string = $this->viewValue($item);
+      $view_value = $this->viewValue($item);
       if ($url) {
         $elements[$delta] = [
           '#type' => 'link',
-          '#title' => $string,
+          '#title' => $view_value,
           '#url' => $url,
         ];
       }
       else {
-        $elements[$delta] = ['#markup' => $string];
+        $elements[$delta] = is_array($view_value) ? $view_value : ['#markup' => $view_value];
       }
     }
     return $elements;
@@ -149,13 +149,15 @@ public function viewElements(FieldItemListInterface $items) {
    * @param \Drupal\Core\Field\FieldItemInterface $item
    *   One field item.
    *
-   * @return string
-   *   The textual output generated.
+   * @return array
+   *   The textual output generated as a render array.
    */
   protected function viewValue(FieldItemInterface $item) {
     // The text value has no text format assigned to it, so the user input
     // should equal the output, including newlines.
-    return nl2br(SafeMarkup::checkPlain($item->value));
+    return [
+      '#markup' => nl2br(Html::escape($item->value))
+    ];
   }
 
 }

core/lib/Drupal/Core/Field/WidgetBase.php

@@ -10,7 +10,6 @@
 use Drupal\Component\Utility\Html;
 use Drupal\Component\Utility\NestedArray;
 use Drupal\Component\Utility\SortArray;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Render\Element;
 use Symfony\Component\Validator\ConstraintViolationInterface;
@@ -85,7 +84,7 @@ public function form(FieldItemListInterface $items, array &$form, FormStateInter
     if ($this->handlesMultipleValues() || isset($get_delta)) {
       $delta = isset($get_delta) ? $get_delta : 0;
       $element = array(
-        '#title' => SafeMarkup::checkPlain($this->fieldDefinition->getLabel()),
+        '#title' => $this->fieldDefinition->getLabel(),
         '#description' => FieldFilteredString::create(\Drupal::token()->replace($this->fieldDefinition->getDescription())),
       );
       $element = $this->formSingleElement($items, $delta, $element, $form, $form_state);
@@ -164,7 +163,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f
         break;
     }
 
-    $title = SafeMarkup::checkPlain($this->fieldDefinition->getLabel());
+    $title = $this->fieldDefinition->getLabel();
     $description = FieldFilteredString::create(\Drupal::token()->replace($this->fieldDefinition->getDescription()));
 
     $elements = array();
@@ -179,7 +178,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f
       // table.
       if ($is_multiple) {
         $element = [
-          '#title' => $title . ' ' . $this->t('(value @number)', ['@number' => $delta + 1]),
+          '#title' => $this->t('@title (value @number)', ['@title' => $title, '@number' => $delta + 1]),
           '#title_display' => 'invisible',
           '#description' => '',
         ];

core/modules/block/src/BlockViewBuilder.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\block;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Block\MainContentBlockPluginInterface;
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Cache\CacheableMetadata;
@@ -164,8 +163,6 @@ protected static function buildPreRenderableBlock($entity, ModuleHandlerInterfac
       '#block' => $entity,
     ];
 
-    $build['#configuration']['label'] = SafeMarkup::checkPlain($configuration['label']);
-
     // If an alter hook wants to modify the block contents, it can append
     // another #pre_render hook.
     $module_handler->alter(['block_view', "block_view_$base_id"], $build, $plugin);

core/modules/block/src/Controller/BlockLibraryController.php

@@ -8,7 +8,6 @@
 namespace Drupal\block\Controller;
 
 use Drupal\Component\Serialization\Json;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Block\BlockManagerInterface;
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\EventSubscriber\MainContentViewSubscriber;
@@ -109,7 +108,7 @@ public function listBlocks(Request $request, $theme) {
         '#prefix' => '<div class="block-filter-text-source">',
         '#suffix' => '</div>',
       ];
-      $row['category']['data'] = SafeMarkup::checkPlain($plugin_definition['category']);
+      $row['category']['data'] = $plugin_definition['category'];
       $links['add'] = [
         'title' => $this->t('Place block'),
         'url' => Url::fromRoute('block.admin_add', ['plugin_id' => $plugin_id, 'theme' => $theme]),

core/modules/color/color.module

@@ -8,7 +8,6 @@
 use Drupal\Core\Asset\CssOptimizer;
 use Drupal\Component\Utility\Bytes;
 use Drupal\Component\Utility\Environment;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Language\LanguageInterface;
@@ -251,7 +250,7 @@ function color_scheme_form($complete_form, FormStateInterface $form_state, $them
     if (isset($names[$name])) {
       $form['palette'][$name] = array(
         '#type' => 'textfield',
-        '#title' => SafeMarkup::checkPlain($names[$name]),
+        '#title' => $names[$name],
         '#value_callback' => 'color_palette_color_value',
         '#default_value' => $value,
         '#size' => 8,

core/modules/comment/src/CommentTypeListBuilder.php

@@ -7,8 +7,6 @@
 
 namespace Drupal\comment;
 
-use Drupal\Component\Utility\SafeMarkup;
-use Drupal\Component\Utility\Xss;
 use Drupal\Core\Config\Entity\ConfigEntityListBuilder;
 use Drupal\Core\Entity\EntityInterface;
 
@@ -45,7 +43,7 @@ public function buildHeader() {
    * {@inheritdoc}
    */
   public function buildRow(EntityInterface $entity) {
-    $row['type'] = SafeMarkup::checkPlain($entity->label());
+    $row['type'] = $entity->label();
     $row['description']['data'] = ['#markup' => $entity->getDescription()];
     return $row + parent::buildRow($entity);
   }

core/modules/config_translation/src/Controller/ConfigTranslationBlockListBuilder.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\config_translation\Controller;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\EntityStorageInterface;
 use Drupal\Core\Entity\EntityTypeInterface;
@@ -70,12 +69,12 @@ public function buildRow(EntityInterface $entity) {
     );
 
     $row['theme'] = array(
-      'data' => SafeMarkup::checkPlain($this->themes[$theme]->info['name']),
+      'data' => $this->themes[$theme]->info['name'],
       'class' => 'table-filter-text-source',
     );
 
     $row['category'] = array(
-      'data' => SafeMarkup::checkPlain($plugin_definition['category']),
+      'data' => $plugin_definition['category'],
       'class' => 'table-filter-text-source',
     );
 

core/modules/config_translation/src/Controller/ConfigTranslationFieldListBuilder.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\config_translation\Controller;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\Unicode;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\EntityManagerInterface;
@@ -123,7 +122,7 @@ public function buildRow(EntityInterface $entity) {
     if ($this->displayBundle()) {
       $bundle = $entity->get('bundle');
       $row['bundle'] = array(
-        'data' => SafeMarkup::checkPlain($this->baseEntityBundles[$bundle]['label']),
+        'data' => $this->baseEntityBundles[$bundle]['label'],
         'class' => 'table-filter-text-source',
       );
     }

core/modules/config_translation/src/Controller/ConfigTranslationMapperList.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\config_translation\Controller;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\config_translation\ConfigMapperInterface;
 use Drupal\Core\Controller\ControllerBase;
 use Symfony\Component\DependencyInjection\ContainerInterface;
@@ -94,7 +93,7 @@ public function render() {
    *   A render array structure of fields for this mapper.
    */
   public function buildRow(ConfigMapperInterface $mapper) {
-    $row['label'] = SafeMarkup::checkPlain($mapper->getTypeLabel());
+    $row['label'] = $mapper->getTypeLabel();
     $row['operations']['data'] = $this->buildOperations($mapper);
     return $row;
   }

core/modules/config_translation/src/Tests/ConfigTranslationOverviewTest.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\config_translation\Tests;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\language\Entity\ConfigurableLanguage;
 use Drupal\simpletest\WebTestBase;
 
@@ -103,7 +102,7 @@ public function testMapperListPage() {
       $base_url = 'admin/structure/config_test/manage/' . $test_entity->id();
       $this->drupalGet('admin/config/regional/config-translation/config_test');
       $this->assertLinkByHref($base_url . '/translate');
-      $this->assertText(SafeMarkup::checkPlain($test_entity->label()));
+      $this->assertEscaped($test_entity->label());
 
       // Make sure there is only a single 'Translate' operation for each
       // dropbutton.

core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php

@@ -753,9 +753,9 @@ public function testFieldConfigTranslation() {
     $this->clickLink('Add');
 
     $this->assertText('Translatable field setting');
-    $this->assertRaw(SafeMarkup::checkPlain($translatable_field_setting));
+    $this->assertEscaped($translatable_field_setting);
     $this->assertText('Translatable storage setting');
-    $this->assertRaw(SafeMarkup::checkPlain($translatable_storage_setting));
+    $this->assertEscaped($translatable_storage_setting);
   }
 
   /**

core/modules/contact/src/Controller/ContactController.php

@@ -11,7 +11,6 @@
 use Drupal\contact\ContactFormInterface;
 use Drupal\Core\Render\RendererInterface;
 use Drupal\user\UserInterface;
-use Drupal\Component\Utility\SafeMarkup;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
@@ -87,7 +86,7 @@ public function contactSitePage(ContactFormInterface $contact_form = NULL) {
       ));
 
     $form = $this->entityFormBuilder()->getForm($message);
-    $form['#title'] = SafeMarkup::checkPlain($contact_form->label());
+    $form['#title'] = $contact_form->label();
     $form['#cache']['contexts'][] = 'user.permissions';
     $this->renderer->addCacheableDependency($form, $config);
     return $form;

core/modules/dblog/src/Controller/DbLogController.php

@@ -8,9 +8,7 @@
 namespace Drupal\dblog\Controller;
 
 use Drupal\Component\Utility\Html;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\Unicode;
-use Drupal\Component\Utility\Xss;
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Datetime\DateFormatter;
@@ -283,7 +281,7 @@ public function eventDetails($event_id) {
         ),
         array(
           array('data' => $this->t('Hostname'), 'header' => TRUE),
-          SafeMarkup::checkPlain($dblog->hostname),
+          $dblog->hostname,
         ),
         array(
           array('data' => $this->t('Operations'), 'header' => TRUE),

core/modules/field/src/Tests/String/UuidFormatterTest.php

@@ -51,7 +51,7 @@ public function testUuidStringFormatter() {
 
     $render_array = $uuid_field->view(['settings' => ['link_to_entity' => TRUE]]);
     $this->assertIdentical($render_array[0]['#type'], 'link');
-    $this->assertIdentical($render_array[0]['#title'], $entity->uuid());
+    $this->assertIdentical($render_array[0]['#title']['#markup'], $entity->uuid());
     $this->assertIdentical($render_array[0]['#url']->toString(), $entity->url());
   }
 

core/modules/field_ui/src/FieldConfigListBuilder.php

@@ -8,7 +8,6 @@
 namespace Drupal\field_ui;
 
 use Drupal\Component\Utility\Html;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Config\Entity\ConfigEntityListBuilder;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\EntityManagerInterface;
@@ -131,7 +130,7 @@ public function buildRow(EntityInterface $field_config) {
     $row = array(
       'id' => Html::getClass($field_config->getName()),
       'data' => array(
-        'label' => SafeMarkup::checkPlain($field_config->getLabel()),
+        'label' => $field_config->getLabel(),
         'field_name' => $field_config->getName(),
         'field_type' => array(
           'data' => array(

core/modules/file/src/Plugin/Field/FieldFormatter/BaseFieldFileFormatterBase.php

@@ -56,17 +56,17 @@ public function viewElements(FieldItemListInterface $items) {
     }
 
     foreach ($items as $delta => $item) {
-      $string = $this->viewValue($item);
+      $view_value = $this->viewValue($item);
 
       if ($url) {
         $elements[$delta] = [
           '#type' => 'link',
-          '#title' => $string,
+          '#title' => $view_value,
           '#url' => Url::fromUri($url),
         ];
       }
       else {
-        $elements[$delta] = is_array($string) ? $string : ['#markup' => $string];
+        $elements[$delta] = is_array($view_value) ? $view_value : ['#markup' => $view_value];
       }
     }
 

core/modules/file/src/Plugin/Field/FieldWidget/FileWidget.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\file\Plugin\Field\FieldWidget;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\NestedArray;
 use Drupal\Core\Field\FieldDefinitionInterface;
 use Drupal\Core\Field\FieldFilteredString;
@@ -119,7 +118,7 @@ protected function formMultipleElements(FieldItemListInterface $items, array &$f
         break;
     }
 
-    $title = SafeMarkup::checkPlain($this->fieldDefinition->getLabel());
+    $title = $this->fieldDefinition->getLabel();
     $description = FieldFilteredString::create($this->fieldDefinition->getDescription());
 
     $elements = array();

core/modules/filter/src/FilterFormatListBuilder.php

@@ -98,10 +98,10 @@ public function buildRow(EntityInterface $entity) {
     if ($entity->isFallbackFormat()) {
       $fallback_choice = $this->configFactory->get('filter.settings')->get('always_show_fallback_choice');
       if ($fallback_choice) {
-        $roles_markup = $this->t('All roles may use this format');
+        $row['roles']['#markup'] = $this->t('All roles may use this format');
       }
       else {
-        $roles_markup = $this->t('This format is shown when no other formats are available');
+        $row['roles']['#markup'] = $this->t('This format is shown when no other formats are available');
       }
       // Emphasize the fallback role text since it is important to understand
       // how it works which configuring filter formats. Additionally, it is not
@@ -110,12 +110,14 @@ public function buildRow(EntityInterface $entity) {
       $row['roles']['#suffix'] = '</em>';
     }
     else {
-      $roles = array_map('\Drupal\Component\Utility\SafeMarkup::checkPlain', filter_get_roles_by_format($entity));
-      $roles_markup = $roles ? implode(', ', $roles) : $this->t('No roles may use this format');
+      $row['roles'] = [
+        '#theme' => 'item_list',
+        '#items' => filter_get_roles_by_format($entity),
+        '#empty' => $this->t('No roles may use this format'),
+        '#context' => ['list_style' => 'comma-list'],
+      ];
     }
 
-    $row['roles']['#markup'] = $roles_markup;
-
     return $row + parent::buildRow($entity);
   }
 

core/modules/filter/src/Plugin/Filter/FilterHtml.php

@@ -149,7 +149,7 @@ public function tips($long = FALSE) {
           array('data' =>
             array(
               '#prefix' => '<code>',
-              '#markup' => Html::escape($tips[$tag][1]),
+              '#plain_text' => $tips[$tag][1],
               '#suffix' => '</code>'
             ),
             'class' => array('type')),
@@ -193,7 +193,7 @@ public function tips($long = FALSE) {
         array(
           'data' => array(
             '#prefix' => '<code>',
-            '#markup' => Html::escape($entity[1]),
+            '#plain_text' => $entity[1],
             '#suffix' => '</code>',
           ),
           'class' => array('type'),

core/modules/help/src/Controller/HelpController.php

@@ -12,7 +12,6 @@
 use Drupal\Core\Url;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
-use Drupal\Component\Utility\SafeMarkup;
 
 /**
  * Controller routines for help routes.
@@ -115,7 +114,7 @@ public function helpPage($name) {
     $build = array();
     if ($this->moduleHandler()->implementsHook($name, 'help')) {
       $module_name =  $this->moduleHandler()->getName($name);
-      $build['#title'] = SafeMarkup::checkPlain($module_name);
+      $build['#title'] = $module_name;
 
       $temp = $this->moduleHandler()->invoke($name, 'help', array("help.page.$name", $this->routeMatch));
       if (empty($temp)) {

core/modules/language/src/Form/NegotiationConfigureForm.php

@@ -8,7 +8,6 @@
 namespace Drupal\language\Form;
 
 use Drupal\Core\Block\BlockManagerInterface;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\Unicode;
 use Drupal\Component\Utility\Xss;
 use Drupal\Core\Config\ConfigFactoryInterface;
@@ -277,22 +276,22 @@ protected function configureFormTable(array &$form, $type)  {
 
       if (isset($types[$type])) {
         $table_form['#language_negotiation_info'][$method_id] = $method;
-        $method_name = SafeMarkup::checkPlain($method['name']);
+        $method_name = $method['name'];
 
         $table_form['weight'][$method_id] = array(
           '#type' => 'weight',
-          '#title' => $this->t('Weight for !title language detection method', array('!title' => Unicode::strtolower($method_name))),
+          '#title' => $this->t('Weight for @title language detection method', array('@title' => Unicode::strtolower($method_name))),
           '#title_display' => 'invisible',
           '#default_value' => $weight,
           '#attributes' => array('class' => array("language-method-weight-$type")),
           '#delta' => 20,
         );
 
-        $table_form['title'][$method_id] = array('#markup' => $method_name);
+        $table_form['title'][$method_id] = array('#plain_text' => $method_name);
 
         $table_form['enabled'][$method_id] = array(
           '#type' => 'checkbox',
-          '#title' => $this->t('Enable !title language detection method', array('!title' => Unicode::strtolower($method_name))),
+          '#title' => $this->t('Enable @title language detection method', array('@title' => Unicode::strtolower($method_name))),
           '#title_display' => 'invisible',
           '#default_value' => $enabled,
         );

core/modules/locale/src/Form/TranslateEditForm.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\locale\Form;
 
-use Drupal\Component\Utility\Html;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Render\Element;
 use Drupal\locale\SourceString;
@@ -73,7 +72,9 @@ public function buildForm(array $form, FormStateInterface $form_state) {
             '#type' => 'item',
             '#title' => $this->t('Source string (@language)', array('@language' => $this->t('Built-in English'))),
             '#title_display' => 'invisible',
-            '#markup' => '<span lang="en">' . Html::escape($source_array[0]) . '</span>',
+            '#plain_text' => $source_array[0],
+            '#preffix' => '<span lang="en">',
+            '#suffix' => '</span>',
           );
         }
         else {
@@ -82,13 +83,16 @@ public function buildForm(array $form, FormStateInterface $form_state) {
           $original_singular = [
             '#type' => 'item',
             '#title' => $this->t('Singular form'),
-            '#markup' => '<span lang="en">' . Html::escape($source_array[0]) . '</span>',
-            '#prefix' => '<span class="visually-hidden">' . $this->t('Source string (@language)', array('@language' => $this->t('Built-in English'))) . '</span>',
+            '#plain_text' => $source_array[0],
+            '#prefix' => '<span class="visually-hidden">' . $this->t('Source string (@language)', array('@language' => $this->t('Built-in English'))) . '</span><span lang="en">',
+            '#suffix' => '</span>',
           ];
           $original_plural = [
             '#type' => 'item',
             '#title' => $this->t('Plural form'),
-            '#markup' => '<span lang="en">' . Html::escape($source_array[1]) . '</span>',
+            '#plain_text' => $source_array[1],
+            '#preffix' => '<span lang="en">',
+            '#suffix' => '</span>',
           ];
           $form['strings'][$string->lid]['original'] = [
             $original_singular,

core/modules/locale/src/Form/TranslationStatusForm.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\locale\Form;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Extension\ModuleHandlerInterface;
 use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
@@ -82,7 +81,7 @@ public function buildForm(array $form, FormStateInterface $form_state) {
 
       // Build data options for the select table.
       foreach ($updates as $langcode => $update) {
-        $title = SafeMarkup::checkPlain($languages[$langcode]->getName());
+        $title = $languages[$langcode]->getName();
         $locale_translation_update_info = array('#theme' => 'locale_translation_update_info');
         foreach (array('updates', 'not_found') as $update_status) {
           if (isset($update[$update_status])) {
@@ -94,7 +93,7 @@ public function buildForm(array $form, FormStateInterface $form_state) {
             'class' => array('label'),
             'data' => array(
               '#title' => $title,
-              '#markup' => $title,
+              '#plain_text' => $title,
             ),
           ),
           'status' => array(

core/modules/node/src/NodeListBuilder.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\node;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Datetime\DateFormatter;
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\Core\Entity\EntityListBuilder;
@@ -119,7 +118,7 @@ public function buildRow(EntityInterface $entity) {
       '#suffix' => ' ' . drupal_render($mark),
       '#url' => $uri,
     );
-    $row['type'] = SafeMarkup::checkPlain(node_get_type_label($entity));
+    $row['type'] = node_get_type_label($entity);
     $row['author']['data'] = array(
       '#theme' => 'username',
       '#account' => $entity->getOwner(),

core/modules/node/src/NodeTypeForm.php

@@ -9,7 +9,6 @@
 
 use Drupal\Core\Entity\EntityForm;
 use Drupal\Core\Entity\EntityManagerInterface;
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Entity\EntityTypeInterface;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Url;
@@ -55,7 +54,7 @@ public function form(array $form, FormStateInterface $form_state) {
 
     $type = $this->entity;
     if ($this->operation == 'add') {
-      $form['#title'] = SafeMarkup::checkPlain($this->t('Add content type'));
+      $form['#title'] = $this->t('Add content type');
       $fields = $this->entityManager->getBaseFieldDefinitions('node');
       // Create a node with a fake bundle using the type's UUID so that we can
       // get the default values for workflow settings.

core/modules/node/src/Plugin/Search/NodeSearch.php

@@ -7,7 +7,6 @@
 
 namespace Drupal\node\Plugin\Search;
 
-use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Access\AccessResult;
 use Drupal\Core\Config\Config;
 use Drupal\Core\Database\Connection;
@@ -346,7 +345,7 @@ protected function prepareResults(StatementInterface $found) {
 
       $result = array(
         'link' => $node->url('canonical', array('absolute' => TRUE, 'language' => $language)),
-        'type' => SafeMarkup::checkPlain($type->label()),
+        'type' => $type->label(),
         'title' => $node->label(),
         'node' => $node,
         'extra' => $extra,
@@ -446,9 +445,15 @@ protected function indexNode(NodeInterface $node) {
       $build = $node_render->view($node, 'search_index', $language->getId());
 
       unset($build['#theme']);
-      $rendered = $this->renderer->renderPlain($build);
 
-      $text = '<h1>' . SafeMarkup::checkPlain($node->label($language->getId())) . '</h1>' . $rendered;
+      // Add the title to text so it is searchable.
+      $build['search_title'] = [
+        '#prefix' => '<h1>',
+        '#plain_text' => $node->label($language->getId()),
+        '#suffix' => '</h1>',
+        '#weight' => -1000
+      ];
+      $text = $this->renderer->renderPlain($build);
 
       // Fetch extra data normally not visible.
       $extra = $this->moduleHandler->invokeAll('node_update_index', array($node, $language->getId()));

core/modules/node/src/Tests/NodeTitleTest.php

@@ -8,6 +8,7 @@
 namespace Drupal\node\Tests;
 
 use Drupal\comment\Tests\CommentTestTrait;
+use Drupal\Component\Utility\Html;
 
 /**
  * Tests node title.
@@ -85,5 +86,22 @@ function testNodeTitle() {
     // Test that 0 appears in the template <h1>.
     $xpath = '//h1';
     $this->assertEqual(current($this->xpath($xpath)), 0, 'Node title is displayed as 0.', 'Node');
+
+    // Test edge case where node title contains special characters.
+    $edge_case_title = 'article\'s "title".';
+    $settings = array(
+      'title' => $edge_case_title,
+    );
+    $node = $this->drupalCreateNode($settings);
+    // Test that the title appears as <title>. The title will be escaped on the
+    // the page.
+    $edge_case_title_escaped = Html::escape($edge_case_title);
+    $this->drupalGet('node/' . $node->id());
+    $this->assertTitle($edge_case_title_escaped . ' | Drupal', 'Page title is equal to article\'s "title".', 'Node');
+
+    // Test that the title appears as <title> when reloading the node page.
+    $this->drupalGet('node/' . $node->id());
+    $this->assertTitle($edge_case_title_escaped . ' | Drupal', 'Page title is equal to article\'s "title".', 'Node');