Yeah, probably does. Even without my patch, I think there is an issue. I filed it here: #1384

The makeapi itself sanitizes things server side, so there isn't much we need to do in this ticket from what I can see. We just need ot ensure we take care of things server side on our end, regardless of makeapi.