Sorry, I was actually looking where Packet130UpdateSign gets used: https://github.com/Bukkit/CraftBukkit/blob/master/src/main/java/net/minecraft/server/PlayerConnection.java#L1372-L1376

However that now points out how many places we are starting to find with a bit more digging where sign lines do get some form of editing.  This really could benefit from a centralized sanitizing solution.