add white list for bidi, rewrite KISSY.escapeHtml