fixing xml escapes, filtering sub_annotations to only sink calls