alphagov/limelight — pull request #62 by pbadenski (2013-04-30 13:12:55+00:00)
Title: Don't double escape what safesync already escaped

We use global escaping of JSON received from backdrop. Because of that
we should not escape things in jQuery and d3.
- in jQuery that requires using html method instead of text method.
- in d3 we cannot use html method because it operates on innerHTML
and this attribute is missing in SVG. Instead we unescape previously
escaped text, and rely on d3 escaping it.

That sounds bizarre but it is more safe to escape by default, than to
expose potential XSS vulnerability.