diff --git a/core/lib/Drupal/Core/Utility/Token.php b/core/lib/Drupal/Core/Utility/Token.php
index f1f80cc..0c5a6a7 100644
--- a/core/lib/Drupal/Core/Utility/Token.php
+++ b/core/lib/Drupal/Core/Utility/Token.php
@@ -7,6 +7,8 @@
 
 namespace Drupal\Core\Utility;
 
+use Drupal\Component\Utility\Html;
+use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Cache\CacheableDependencyInterface;
 use Drupal\Core\Cache\CacheBackendInterface;
@@ -160,12 +162,6 @@ public function __construct(ModuleHandlerInterface $module_handler, CacheBackend
    *     final text.
    *   - clear: A boolean flag indicating that tokens should be removed from the
    *     final text if no replacement value can be generated.
-   *   - sanitize: A boolean flag indicating that tokens should be sanitized for
-   *     display to a web browser. Defaults to TRUE. Developers who set this
-   *     option to FALSE assume responsibility for running
-   *     \Drupal\Component\Utility\Xss::filter(),
-   *     \Drupal\Component\Utility\Html::escape() or other appropriate scrubbing
-   *     functions before displaying data to users.
    * @param \Drupal\Core\Render\BubbleableMetadata $bubbleable_metadata|null
    *   (optional) An object to which static::generate() and the hooks and
    *   functions that it invokes will add their required bubbleable metadata.
@@ -185,7 +181,13 @@ public function __construct(ModuleHandlerInterface $module_handler, CacheBackend
    *   Renderer's currently active render context.
    *
    * @return string
-   *   Text with tokens replaced.
+   *   Text with tokens replaced. Note that the token replacements may contain
+   *   user input and the resulting string should be considered unsafe and needs
+   *   to be escaped or filtered before output.
+   *
+   *   This means in those case the result is rendered in HTML, one good
+   *   strategy to put the result into a #markup and by that applying
+   *   Xss::filter().
    */
   public function replace($text, array $data = array(), array $options = array(), BubbleableMetadata $bubbleable_metadata = NULL) {
     $text_tokens = $this->scan($text);
@@ -210,8 +212,12 @@ public function replace($text, array $data = array(), array $options = array(),
       $function($replacements, $data, $options, $bubbleable_metadata);
     }
 
-    $tokens = array_keys($replacements);
-    $values = array_values($replacements);
+    $tokens = [];
+    $values = [];
+    foreach ($replacements as $token => $value) {
+      $tokens[] = $token;
+      $values[] = SafeMarkup::isSafe($value) ? (string) $value : Html::escape($value);
+    }
 
     // If a local $bubbleable_metadata object was created, apply the metadata
     // it collected to the renderer's currently active render context.
@@ -282,11 +288,6 @@ public function scan($text) {
    *     array of token replacements after they are generated. Can be used when
    *     modules require special formatting of token text, for example URL
    *     encoding or truncation to a specific length.
-   *   - sanitize: A boolean flag indicating that tokens should be sanitized for
-   *     display to a web browser. Developers who set this option to FALSE assume
-   *     responsibility for running \Drupal\Component\Utility\Xss::filter(),
-   *     \Drupal\Component\Utility\Html::escape() or other appropriate scrubbing
-   *     functions before displaying data to users.
    * @param \Drupal\Core\Render\BubbleableMetadata $bubbleable_metadata
    *    The bubbleable metadata. This is passed to the token replacement
    *    implementations so that they can attach their metadata.
@@ -300,8 +301,6 @@ public function scan($text) {
    * @see hook_tokens_alter()
    */
   public function generate($type, array $tokens, array $data, array $options, BubbleableMetadata $bubbleable_metadata) {
-    $options += array('sanitize' => TRUE);
-
     foreach ($data as $object) {
       if ($object instanceof CacheableDependencyInterface || $object instanceof AttachmentsInterface) {
         $bubbleable_metadata->addCacheableDependency($object);
diff --git a/core/lib/Drupal/Core/Utility/token.api.php b/core/lib/Drupal/Core/Utility/token.api.php
index 57a1e6d..8c8e434 100644
--- a/core/lib/Drupal/Core/Utility/token.api.php
+++ b/core/lib/Drupal/Core/Utility/token.api.php
@@ -65,7 +65,8 @@
  *
  * @return array
  *   An associative array of replacement values, keyed by the raw [type:token]
- *   strings from the original text.
+ *   strings from the original text. The returned values may contain unsafe
+ *   user input and other HTML and must be escaped or filtered before output.
  *
  * @see hook_token_info()
  * @see hook_tokens_alter()
@@ -81,8 +82,6 @@ function hook_tokens($type, $tokens, array $data, array $options, \Drupal\Core\R
   else {
     $langcode = NULL;
   }
-  $sanitize = !empty($options['sanitize']);
-
   $replacements = array();
 
   if ($type == 'node' && !empty($data['node'])) {
@@ -97,7 +96,7 @@ function hook_tokens($type, $tokens, array $data, array $options, \Drupal\Core\R
           break;
 
         case 'title':
-          $replacements[$original] = $sanitize ? Html::escape($node->getTitle()) : $node->getTitle();
+          $replacements[$original] = $node->getTitle();
           break;
 
         case 'edit-url':
@@ -107,7 +106,7 @@ function hook_tokens($type, $tokens, array $data, array $options, \Drupal\Core\R
         // Default values for the chained tokens handled below.
         case 'author':
           $account = $node->getOwner() ? $node->getOwner() : User::load(0);
-          $replacements[$original] = $sanitize ? Html::escape($account->label()) : $account->label();
+          $replacements[$original] = $account->label();
           $bubbleable_metadata->addCacheableDependency($account);
           break;
 
diff --git a/core/modules/action/src/Plugin/Action/MessageAction.php b/core/modules/action/src/Plugin/Action/MessageAction.php
index c87b606..8463c05 100644
--- a/core/modules/action/src/Plugin/Action/MessageAction.php
+++ b/core/modules/action/src/Plugin/Action/MessageAction.php
@@ -7,11 +7,11 @@
 
 namespace Drupal\action\Plugin\Action;
 
-use Drupal\Component\Utility\Xss;
 use Drupal\Core\Access\AccessResult;
 use Drupal\Core\Action\ConfigurableActionBase;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Render\Renderer;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Utility\Token;
 use Symfony\Component\DependencyInjection\ContainerInterface;
@@ -28,16 +28,33 @@
 class MessageAction extends ConfigurableActionBase implements ContainerFactoryPluginInterface {
 
   /**
+   * The renderer.
+   *
+   * We depend on the XSS filtering in
+   * \Drupal\Core\Render|Renderer::renderPlain(), so we cannot type hint on
+   * \Drupal\Core\Render\RendererInterface.
+   *
+   * @var \Drupal\Core\Render\Renderer
+   */
+  protected $renderer;
+
+  /**
    * @var \Drupal\Core\Utility\Token
    */
   protected $token;
 
   /**
    * Constructs a MessageAction object.
+   *
+   * @param \Drupal\Core\Render\Renderer $renderer
+   *   The renderer. We depend on the XSS filtering in
+   *   \Drupal\Core\Render|Renderer::renderPlain(), so we cannot type hint on
+   *   \Drupal\Core\Render\RendererInterface.
    */
-  public function __construct(array $configuration, $plugin_id, $plugin_definition, Token $token) {
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, Token $token, Renderer $renderer) {
     parent::__construct($configuration, $plugin_id, $plugin_definition);
 
+    $this->renderer = $renderer;
     $this->token = $token;
   }
 
@@ -45,7 +62,13 @@ public function __construct(array $configuration, $plugin_id, $plugin_definition
    * {@inheritdoc}
    */
   public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
-    return new static($configuration, $plugin_id, $plugin_definition, $container->get('token'));
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('token'),
+      $container->get('renderer')
+    );
   }
 
   /**
@@ -55,7 +78,15 @@ public function execute($entity = NULL) {
     if (empty($this->configuration['node'])) {
       $this->configuration['node'] = $entity;
     }
-    $message = $this->token->replace(Xss::filterAdmin($this->configuration['message']), $this->configuration);
+
+    // Depend on \Drupal\Core\Render\Renderer::renderPlain()'s sanitization of
+    // the message, so it won't be fully escaped during the main rendering
+    // process.
+    $build = [
+      '#markup' => $this->token->replace($this->configuration['message'], $this->configuration),
+    ];
+    $message = $this->renderer->renderPlain($build);
+
     drupal_set_message($message);
   }
 
diff --git a/core/modules/comment/comment.tokens.inc b/core/modules/comment/comment.tokens.inc
index 500533e..3293c57 100644
--- a/core/modules/comment/comment.tokens.inc
+++ b/core/modules/comment/comment.tokens.inc
@@ -119,8 +119,6 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
   else {
     $langcode = NULL;
   }
-  $sanitize = !empty($options['sanitize']);
-
   $replacements = array();
 
   if ($type == 'comment' && !empty($data['comment'])) {
@@ -136,7 +134,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
 
         // Poster identity information for comments.
         case 'hostname':
-          $replacements[$original] = $sanitize ? Html::escape($comment->getHostname()) : $comment->getHostname();
+          $replacements[$original] = $comment->getHostname();
           break;
 
         case 'mail':
@@ -146,23 +144,23 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
           if ($comment->getOwnerId()) {
             $bubbleable_metadata->addCacheableDependency($comment->getOwner());
           }
-          $replacements[$original] = $sanitize ? Html::escape($mail) : $mail;
+          $replacements[$original] = $mail;
           break;
 
         case 'homepage':
-          $replacements[$original] = $sanitize ? UrlHelper::filterBadProtocol($comment->getHomepage()) : $comment->getHomepage();
+          $replacements[$original] = $comment->getHomepage();
           break;
 
         case 'title':
-          $replacements[$original] = $sanitize ? Xss::filter($comment->getSubject()) : $comment->getSubject();
+          $replacements[$original] = $comment->getSubject();
           break;
 
         case 'body':
-          $replacements[$original] = $sanitize ? $comment->comment_body->processed : $comment->comment_body->value;
+          $replacements[$original] = $comment->comment_body->processed;
           break;
 
         case 'langcode':
-          $replacements[$original] = $sanitize ? Html::escape($comment->language()->getId()) : $comment->language()->getId();
+          $replacements[$original] = $comment->language()->getId();
           break;
 
         // Comment related URLs.
@@ -183,14 +181,14 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
           if ($comment->getOwnerId()) {
             $bubbleable_metadata->addCacheableDependency($comment->getOwner());
           }
-          $replacements[$original] = $sanitize ? Xss::filter($name) : $name;
+          $replacements[$original] = $name;
           break;
 
         case 'parent':
           if ($comment->hasParentComment()) {
             $parent = $comment->getParentComment();
             $bubbleable_metadata->addCacheableDependency($parent);
-            $replacements[$original] = $sanitize ? Xss::filter($parent->getSubject()) : $parent->getSubject();
+            $replacements[$original] = $parent->getSubject();
           }
           break;
 
@@ -210,7 +208,7 @@ function comment_tokens($type, $tokens, array $data, array $options, BubbleableM
           $entity = $comment->getCommentedEntity();
           $bubbleable_metadata->addCacheableDependency($entity);
           $title = $entity->label();
-          $replacements[$original] = $sanitize ? Xss::filter($title) : $title;
+          $replacements[$original] = $title;
           break;
       }
     }
diff --git a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
index 0bc6be6..e0a1652 100644
--- a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
+++ b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
@@ -53,26 +53,26 @@ function testCommentTokenReplacement() {
     // Generate and test sanitized tokens.
     $tests = array();
     $tests['[comment:cid]'] = $comment->id();
-    $tests['[comment:hostname]'] = Html::escape($comment->getHostname());
-    $tests['[comment:author]'] = Xss::filter($comment->getAuthorName());
-    $tests['[comment:mail]'] = Html::escape($this->adminUser->getEmail());
-    $tests['[comment:homepage]'] = UrlHelper::filterBadProtocol($comment->getHomepage());
-    $tests['[comment:title]'] = Xss::filter($comment->getSubject());
+    $tests['[comment:hostname]'] = $comment->getHostname();
+    $tests['[comment:author]'] = $comment->getAuthorName();
+    $tests['[comment:mail]'] = $this->adminUser->getEmail();
+    $tests['[comment:homepage]'] = $comment->getHomepage();
+    $tests['[comment:title]'] = $comment->getSubject();
     $tests['[comment:body]'] = $comment->comment_body->processed;
-    $tests['[comment:langcode]'] = Html::escape($comment->language()->getId());
+    $tests['[comment:langcode]'] = $comment->language()->getId();
     $tests['[comment:url]'] = $comment->url('canonical', $url_options + array('fragment' => 'comment-' . $comment->id()));
     $tests['[comment:edit-url]'] = $comment->url('edit-form', $url_options);
     $tests['[comment:created]'] = \Drupal::service('date.formatter')->format($comment->getCreatedTime(), 'medium', array('langcode' => $language_interface->getId()));
     $tests['[comment:created:since]'] = \Drupal::service('date.formatter')->formatTimeDiffSince($comment->getCreatedTime(), array('langcode' => $language_interface->getId()));
     $tests['[comment:changed:since]'] = \Drupal::service('date.formatter')->formatTimeDiffSince($comment->getChangedTimeAcrossTranslations(), array('langcode' => $language_interface->getId()));
     $tests['[comment:parent:cid]'] = $comment->hasParentComment() ? $comment->getParentComment()->id() : NULL;
-    $tests['[comment:parent:title]'] = Html::escape($parent_comment->getSubject());
-    $tests['[comment:entity]'] = Html::escape($node->getTitle());
+    $tests['[comment:parent:title]'] = $parent_comment->getSubject();
+    $tests['[comment:entity]'] = $node->getTitle();
     // Test node specific tokens.
     $tests['[comment:entity:nid]'] = $comment->getCommentedEntityId();
-    $tests['[comment:entity:title]'] = Html::escape($node->getTitle());
+    $tests['[comment:entity:title]'] = $node->getTitle();
     $tests['[comment:author:uid]'] = $comment->getOwnerId();
-    $tests['[comment:author:name]'] = Html::escape($this->adminUser->getUsername());
+    $tests['[comment:author:name]'] = $this->adminUser->getUsername();
 
     $base_bubbleable_metadata = BubbleableMetadata::createFromObject($comment);
     $metadata_tests = [];
@@ -114,35 +114,16 @@ function testCommentTokenReplacement() {
     foreach ($tests as $input => $expected) {
       $bubbleable_metadata = new BubbleableMetadata();
       $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId()), $bubbleable_metadata);
-      $this->assertEqual($output, $expected, format_string('Sanitized comment token %token replaced.', array('%token' => $input)));
+      $this->assertEqual($output, $expected, format_string('Comment token %token replaced.', array('%token' => $input)));
       $this->assertEqual($bubbleable_metadata, $metadata_tests[$input]);
     }
 
-    // Generate and test unsanitized tokens.
-    $tests['[comment:hostname]'] = $comment->getHostname();
-    $tests['[comment:author]'] = $comment->getAuthorName();
-    $tests['[comment:mail]'] = $this->adminUser->getEmail();
-    $tests['[comment:homepage]'] = $comment->getHomepage();
-    $tests['[comment:title]'] = $comment->getSubject();
-    $tests['[comment:body]'] = $comment->comment_body->value;
-    $tests['[comment:langcode]'] = $comment->language()->getId();
-    $tests['[comment:parent:title]'] = $parent_comment->getSubject();
-    $tests['[comment:entity]'] = $node->getTitle();
-    $tests['[comment:author:name]'] = $this->adminUser->getUsername();
-
-    foreach ($tests as $input => $expected) {
-      $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId(), 'sanitize' => FALSE));
-      $this->assertEqual($output, $expected, format_string('Unsanitized comment token %token replaced.', array('%token' => $input)));
-    }
-
     // Test anonymous comment author.
     $author_name = $this->randomString();
     $comment->setOwnerId(0)->setAuthorName($author_name);
     $input = '[comment:author]';
     $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId()));
-    $this->assertEqual($output, Xss::filter($author_name), format_string('Sanitized comment author token %token replaced.', array('%token' => $input)));
-    $output = $token_service->replace($input, array('comment' => $comment), array('langcode' => $language_interface->getId(), 'sanitize' => FALSE));
-    $this->assertEqual($output, $author_name, format_string('Unsanitized comment author token %token replaced.', array('%token' => $input)));
+    $this->assertEqual($output, $author_name, format_string('Comment author token %token replaced.', array('%token' => $input)));
 
     // Load node so comment_count gets computed.
     $node = Node::load($node->id());
diff --git a/core/modules/content_translation/content_translation.module b/core/modules/content_translation/content_translation.module
index 36557cd..cbba524 100644
--- a/core/modules/content_translation/content_translation.module
+++ b/core/modules/content_translation/content_translation.module
@@ -471,14 +471,7 @@ function content_translation_language_configuration_element_process(array $eleme
     );
 
     $submit_name = isset($form['actions']['save_continue']) ? 'save_continue' : 'submit';
-    // Only add the submit handler on the submit button if the #submit property
-    // is already available, otherwise this breaks the form submit function.
-    if (isset($form['actions'][$submit_name]['#submit'])) {
-      $form['actions'][$submit_name]['#submit'][] = 'content_translation_language_configuration_element_submit';
-    }
-    else {
-      $form['#submit'][] = 'content_translation_language_configuration_element_submit';
-    }
+    $form['actions'][$submit_name]['#submit'][] = 'content_translation_language_configuration_element_submit';
   }
   return $element;
 }
diff --git a/core/modules/content_translation/src/Tests/ContentTranslationSettingsTest.php b/core/modules/content_translation/src/Tests/ContentTranslationSettingsTest.php
index f1ddd4a..c928bac 100644
--- a/core/modules/content_translation/src/Tests/ContentTranslationSettingsTest.php
+++ b/core/modules/content_translation/src/Tests/ContentTranslationSettingsTest.php
@@ -217,11 +217,6 @@ function testAccountLanguageSettingsUI() {
     $this->drupalPostForm('admin/config/people/accounts', $edit, t('Save configuration'));
     $this->drupalGet('admin/config/people/accounts');
     $this->assertFieldChecked('edit-language-content-translation');
-
-    // Make sure account settings can be saved.
-    $this->drupalPostForm('admin/config/people/accounts', array('anonymous' => 'Save me please!'), 'Save configuration');
-    $this->assertFieldByName('anonymous', 'Save me please!', 'Anonymous name has been changed.');
-    $this->assertText('The configuration options have been saved.');
   }
 
   /**
diff --git a/core/modules/file/file.module b/core/modules/file/file.module
index 3c677ea..9a6a97c 100644
--- a/core/modules/file/file.module
+++ b/core/modules/file/file.module
@@ -951,7 +951,6 @@ function file_tokens($type, $tokens, array $data, array $options, BubbleableMeta
   else {
     $langcode = NULL;
   }
-  $sanitize = !empty($options['sanitize']);
 
   $replacements = array();
 
@@ -968,15 +967,15 @@ function file_tokens($type, $tokens, array $data, array $options, BubbleableMeta
 
         // Essential file data
         case 'name':
-          $replacements[$original] = $sanitize ? Html::escape($file->getFilename()) : $file->getFilename();
+          $replacements[$original] = $file->getFilename();
           break;
 
         case 'path':
-          $replacements[$original] = $sanitize ? Html::escape($file->getFileUri()) : $file->getFileUri();
+          $replacements[$original] = $file->getFileUri();
           break;
 
         case 'mime':
-          $replacements[$original] = $sanitize ? Html::escape($file->getMimeType()) : $file->getMimeType();
+          $replacements[$original] = $file->getMimeType();
           break;
 
         case 'size':
@@ -984,7 +983,7 @@ function file_tokens($type, $tokens, array $data, array $options, BubbleableMeta
           break;
 
         case 'url':
-          $replacements[$original] = $sanitize ? Html::escape(file_create_url($file->getFileUri())) : file_create_url($file->getFileUri());
+          $replacements[$original] = file_create_url($file->getFileUri());
           break;
 
         // These tokens are default variations on the chained tokens handled below.
@@ -1004,7 +1003,7 @@ function file_tokens($type, $tokens, array $data, array $options, BubbleableMeta
           $owner = $file->getOwner();
           $bubbleable_metadata->addCacheableDependency($owner);
           $name = $owner->label();
-          $replacements[$original] = $sanitize ? Html::escape($name) : $name;
+          $replacements[$original] = $name;
           break;
       }
     }
diff --git a/core/modules/file/src/Plugin/Field/FieldType/FileItem.php b/core/modules/file/src/Plugin/Field/FieldType/FileItem.php
index afff2a3..3db05ee 100644
--- a/core/modules/file/src/Plugin/Field/FieldType/FileItem.php
+++ b/core/modules/file/src/Plugin/Field/FieldType/FileItem.php
@@ -260,7 +260,7 @@ public static function validateMaxFilesize($element, FormStateInterface $form_st
    *   An array of token objects to pass to token_replace().
    *
    * @return string
-   *   A file directory URI with tokens replaced.
+   *   An unsanitized file directory URI with tokens replaced.
    *
    * @see token_replace()
    */
@@ -268,9 +268,11 @@ public function getUploadLocation($data = array()) {
     $settings = $this->getSettings();
     $destination = trim($settings['file_directory'], '/');
 
-    // Replace tokens.
+    // Replace tokens. We do not apply any sanitization to the destination here.
     $destination = \Drupal::token()->replace($destination, $data);
 
+    // @todo Is any valid URI always safe output? If so, handle invalid URIs
+    //   here, and certainly do not return them.
     return $settings['uri_scheme'] . '://' . $destination;
   }
 
diff --git a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php
index ed80376..a57c8b8 100644
--- a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php
+++ b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkFormatter.php
@@ -188,9 +188,7 @@ public function viewElements(FieldItemListInterface $items) {
 
       // If the title field value is available, use it for the link text.
       if (empty($settings['url_only']) && !empty($item->title)) {
-        // Unsanitized token replacement here because the entire link title
-        // gets auto-escaped during link generation.
-        $link_title = \Drupal::token()->replace($item->title, array($entity->getEntityTypeId() => $entity), array('sanitize' => FALSE, 'clear' => TRUE));
+        $link_title = \Drupal::token()->replace($item->title, array($entity->getEntityTypeId() => $entity), array('clear' => TRUE));
       }
 
       // Trim the link text to the desired length.
diff --git a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkSeparateFormatter.php b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkSeparateFormatter.php
index 3ea2770..26d2547 100644
--- a/core/modules/link/src/Plugin/Field/FieldFormatter/LinkSeparateFormatter.php
+++ b/core/modules/link/src/Plugin/Field/FieldFormatter/LinkSeparateFormatter.php
@@ -54,9 +54,7 @@ public function viewElements(FieldItemListInterface $items) {
 
       // If the link text field value is available, use it for the text.
       if (empty($settings['url_only']) && !empty($item->title)) {
-        // Unsanitized token replacement here because the entire link title
-        // gets auto-escaped during link generation.
-        $link_title = \Drupal::token()->replace($item->title, array($entity->getEntityTypeId() => $entity), array('sanitize' => FALSE, 'clear' => TRUE));
+        $link_title = \Drupal::token()->replace($item->title, array($entity->getEntityTypeId() => $entity), array('clear' => TRUE));
       }
 
       // The link_separate formatter has two titles; the link text (as in the
diff --git a/core/modules/node/node.tokens.inc b/core/modules/node/node.tokens.inc
index 3294044..9388d68 100644
--- a/core/modules/node/node.tokens.inc
+++ b/core/modules/node/node.tokens.inc
@@ -96,8 +96,6 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta
   else {
     $langcode = LanguageInterface::LANGCODE_DEFAULT;
   }
-  $sanitize = !empty($options['sanitize']);
-
   $replacements = array();
 
   if ($type == 'node' && !empty($data['node'])) {
@@ -116,16 +114,16 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta
           break;
 
         case 'type':
-          $replacements[$original] = $sanitize ? Html::escape($node->getType()) : $node->getType();
+          $replacements[$original] = $node->getType();
           break;
 
         case 'type-name':
           $type_name = node_get_type_label($node);
-          $replacements[$original] = $sanitize ? Html::escape($type_name) : $type_name;
+          $replacements[$original] = $type_name;
           break;
 
         case 'title':
-          $replacements[$original] = $sanitize ? Html::escape($node->getTitle()) : $node->getTitle();
+          $replacements[$original] = $node->getTitle();
           break;
 
         case 'body':
@@ -133,14 +131,13 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta
           $translation = \Drupal::entityManager()->getTranslationFromContext($node, $langcode, array('operation' => 'node_tokens'));
           if ($translation->hasField('body') && ($items = $translation->get('body')) && !$items->isEmpty()) {
             $item = $items[0];
-            $field_definition = \Drupal::entityManager()->getFieldDefinitions('node', $node->bundle())['body'];
             // If the summary was requested and is not empty, use it.
             if ($name == 'summary' && !empty($item->summary)) {
-              $output = $sanitize ? $item->summary_processed : $item->summary;
+              $output = $item->summary_processed;
             }
             // Attempt to provide a suitable version of the 'body' field.
             else {
-              $output = $sanitize ? $item->processed : $item->value;
+              $output = $item->processed;
               // A summary was requested.
               if ($name == 'summary') {
                 // Generate an optionally trimmed summary of the body field.
@@ -164,7 +161,7 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta
           break;
 
         case 'langcode':
-          $replacements[$original] = $sanitize ? Html::escape($node->language()->getId()) : $node->language()->getId();
+          $replacements[$original] = $node->language()->getId();
           break;
 
         case 'url':
@@ -179,7 +176,7 @@ function node_tokens($type, $tokens, array $data, array $options, BubbleableMeta
         case 'author':
           $account = $node->getOwner() ? $node->getOwner() : User::load(0);
           $bubbleable_metadata->addCacheableDependency($account);
-          $replacements[$original] = $sanitize ? Html::escape($account->label()) : $account->label();
+          $replacements[$original] = $account->label();
           break;
 
         case 'created':
diff --git a/core/modules/node/src/Tests/NodeTokenReplaceTest.php b/core/modules/node/src/Tests/NodeTokenReplaceTest.php
index 3ec91d9..f434bbe 100644
--- a/core/modules/node/src/Tests/NodeTokenReplaceTest.php
+++ b/core/modules/node/src/Tests/NodeTokenReplaceTest.php
@@ -55,25 +55,25 @@ function testNodeTokenReplacement() {
       'tnid' => 0,
       'uid' => $account->id(),
       'title' => '<blink>Blinking Text</blink>',
-      'body' => array(array('value' => $this->randomMachineName(32), 'summary' => $this->randomMachineName(16), 'format' => 'plain_text')),
+      'body' => array(array('value' => 'Regular NODE body for the test.', 'summary' => 'Fancy NODE summary.', 'format' => 'plain_text')),
     ));
     $node->save();
 
-    // Generate and test sanitized tokens.
+    // Generate and test tokens.
     $tests = array();
     $tests['[node:nid]'] = $node->id();
     $tests['[node:vid]'] = $node->getRevisionId();
     $tests['[node:type]'] = 'article';
     $tests['[node:type-name]'] = 'Article';
-    $tests['[node:title]'] = Html::escape($node->getTitle());
-    $tests['[node:body]'] = $node->body->processed;
-    $tests['[node:summary]'] = $node->body->summary_processed;
-    $tests['[node:langcode]'] = Html::escape($node->language()->getId());
+    $tests['[node:title]'] = $node->getTitle();
+    $tests['[node:body]'] = check_markup($node->body->value, 'plain_text');
+    $tests['[node:summary]'] = check_markup($node->body->summary, 'plain_text');
+    $tests['[node:langcode]'] = $node->language()->getId();
     $tests['[node:url]'] = $node->url('canonical', $url_options);
     $tests['[node:edit-url]'] = $node->url('edit-form', $url_options);
-    $tests['[node:author]'] = Html::escape($account->getUsername());
+    $tests['[node:author]'] = $account->getUsername();
     $tests['[node:author:uid]'] = $node->getOwnerId();
-    $tests['[node:author:name]'] = Html::escape($account->getUsername());
+    $tests['[node:author:name]'] = $account->getUsername();
     $tests['[node:created:since]'] = \Drupal::service('date.formatter')->formatTimeDiffSince($node->getCreatedTime(), array('langcode' => $this->interfaceLanguage->getId()));
     $tests['[node:changed:since]'] = \Drupal::service('date.formatter')->formatTimeDiffSince($node->getChangedTime(), array('langcode' => $this->interfaceLanguage->getId()));
 
@@ -104,49 +104,29 @@ function testNodeTokenReplacement() {
     foreach ($tests as $input => $expected) {
       $bubbleable_metadata = new BubbleableMetadata();
       $output = $this->tokenService->replace($input, array('node' => $node), array('langcode' => $this->interfaceLanguage->getId()), $bubbleable_metadata);
-      $this->assertEqual($output, $expected, format_string('Sanitized node token %token replaced.', array('%token' => $input)));
+      $this->assertEqual($output, $expected, format_string('Node token %token replaced.', array('%token' => $input)));
       $this->assertEqual($bubbleable_metadata, $metadata_tests[$input]);
     }
 
-    // Generate and test unsanitized tokens.
-    $tests['[node:title]'] = $node->getTitle();
-    $tests['[node:body]'] = $node->body->value;
-    $tests['[node:summary]'] = $node->body->summary;
-    $tests['[node:langcode]'] = $node->language()->getId();
-    $tests['[node:author:name]'] = $account->getUsername();
-
-    foreach ($tests as $input => $expected) {
-      $output = $this->tokenService->replace($input, array('node' => $node), array('langcode' => $this->interfaceLanguage->getId(), 'sanitize' => FALSE));
-      $this->assertEqual($output, $expected, format_string('Unsanitized node token %token replaced.', array('%token' => $input)));
-    }
-
     // Repeat for a node without a summary.
     $node = entity_create('node', array(
       'type' => 'article',
       'uid' => $account->id(),
       'title' => '<blink>Blinking Text</blink>',
-      'body' => array(array('value' => $this->randomMachineName(32), 'format' => 'plain_text')),
+      'body' => array(array('value' => 'A string that looks random like TR5c2I', 'format' => 'plain_text')),
     ));
     $node->save();
 
-    // Generate and test sanitized token - use full body as expected value.
+    // Generate and test token - use full body as expected value.
     $tests = array();
-    $tests['[node:summary]'] = $node->body->processed;
+    $tests['[node:summary]'] = check_markup($node->body->value, 'plain_text');
 
     // Test to make sure that we generated something for each token.
     $this->assertFalse(in_array(0, array_map('strlen', $tests)), 'No empty tokens generated for node without a summary.');
 
     foreach ($tests as $input => $expected) {
       $output = $this->tokenService->replace($input, array('node' => $node), array('language' => $this->interfaceLanguage));
-      $this->assertEqual($output, $expected, format_string('Sanitized node token %token replaced for node without a summary.', array('%token' => $input)));
-    }
-
-    // Generate and test unsanitized tokens.
-    $tests['[node:summary]'] = $node->body->value;
-
-    foreach ($tests as $input => $expected) {
-      $output = $this->tokenService->replace($input, array('node' => $node), array('language' => $this->interfaceLanguage, 'sanitize' => FALSE));
-      $this->assertEqual($output, $expected, format_string('Unsanitized node token %token replaced for node without a summary.', array('%token' => $input)));
+      $this->assertEqual($output, $expected, format_string('Node token %token replaced for node without a summary.', array('%token' => $input)));
     }
   }
 
diff --git a/core/modules/system/src/Tests/System/TokenReplaceUnitTest.php b/core/modules/system/src/Tests/System/TokenReplaceUnitTest.php
index 33f867a..7257bf8 100644
--- a/core/modules/system/src/Tests/System/TokenReplaceUnitTest.php
+++ b/core/modules/system/src/Tests/System/TokenReplaceUnitTest.php
@@ -92,7 +92,6 @@ public function testSystemSiteTokenReplacement() {
     );
 
     $slogan = '<blink>Slogan</blink>';
-    $safe_slogan = Xss::filterAdmin($slogan);
 
     // Set a few site variables.
     $config = $this->config('system.site');
@@ -103,10 +102,10 @@ public function testSystemSiteTokenReplacement() {
       ->save();
 
 
-    // Generate and test sanitized tokens.
+    // Generate and test tokens.
     $tests = array();
-    $tests['[site:name]'] = Html::escape($config->get('name'));
-    $tests['[site:slogan]'] = $safe_slogan;
+    $tests['[site:name]'] = $config->get('name');
+    $tests['[site:slogan]'] = $slogan;
     $tests['[site:mail]'] = $config->get('mail');
     $tests['[site:url]'] = \Drupal::url('<front>', [], $url_options);
     $tests['[site:url-brief]'] = preg_replace(array('!^https?://!', '!/$!'), '', \Drupal::url('<front>', [], $url_options));
@@ -129,29 +128,9 @@ public function testSystemSiteTokenReplacement() {
     foreach ($tests as $input => $expected) {
       $bubbleable_metadata = new BubbleableMetadata();
       $output = $this->tokenService->replace($input, array(), array('langcode' => $this->interfaceLanguage->getId()), $bubbleable_metadata);
-      $this->assertEqual($output, $expected, format_string('Sanitized system site information token %token replaced.', array('%token' => $input)));
+      $this->assertEqual($output, $expected, format_string('System site information token %token replaced.', array('%token' => $input)));
       $this->assertEqual($bubbleable_metadata, $metadata_tests[$input]);
     }
-
-    // Generate and test unsanitized tokens.
-    $tests['[site:name]'] = $config->get('name');
-    $tests['[site:slogan]'] = $config->get('slogan');
-
-    foreach ($tests as $input => $expected) {
-      $output = $this->tokenService->replace($input, array(), array('langcode' => $this->interfaceLanguage->getId(), 'sanitize' => FALSE), $bubbleable_metadata);
-      $this->assertEqual($output, $expected, format_string('Unsanitized system site information token %token replaced.', array('%token' => $input)));
-    }
-
-    // Check that the results of Token::generate are sanitized properly. This
-    // does NOT test the cleanliness of every token -- just that the $sanitize
-    // flag is being passed properly through the call stack and being handled
-    // correctly by a 'known' token, [site:slogan].
-    $raw_tokens = array('slogan' => '[site:slogan]');
-    $generated = $this->tokenService->generate('site', $raw_tokens, [], [], $bubbleable_metadata);
-    $this->assertEqual($generated['[site:slogan]'], $safe_slogan, 'Token sanitized.');
-
-    $generated = $this->tokenService->generate('site', $raw_tokens, array(), array('sanitize' => FALSE), $bubbleable_metadata);
-    $this->assertEqual($generated['[site:slogan]'], $slogan, 'Unsanitized token generated properly.');
   }
 
   /**
diff --git a/core/modules/system/system.tokens.inc b/core/modules/system/system.tokens.inc
index a11f55d..a3af309 100644
--- a/core/modules/system/system.tokens.inc
+++ b/core/modules/system/system.tokens.inc
@@ -100,8 +100,6 @@ function system_tokens($type, $tokens, array $data, array $options, BubbleableMe
   else {
     $langcode = NULL;
   }
-  $sanitize = !empty($options['sanitize']);
-
   $replacements = array();
 
   if ($type == 'site') {
@@ -111,14 +109,14 @@ function system_tokens($type, $tokens, array $data, array $options, BubbleableMe
           $config = \Drupal::config('system.site');
           $bubbleable_metadata->addCacheableDependency($config);
           $site_name = $config->get('name');
-          $replacements[$original] = $sanitize ? Html::escape($site_name) : $site_name;
+          $replacements[$original] = $site_name;
           break;
 
         case 'slogan':
           $config = \Drupal::config('system.site');
           $bubbleable_metadata->addCacheableDependency($config);
           $slogan = $config->get('slogan');
-          $replacements[$original] = $sanitize ? Xss::filterAdmin($slogan) : $slogan;
+          $replacements[$original] = $slogan;
           break;
 
         case 'mail':
@@ -178,7 +176,7 @@ function system_tokens($type, $tokens, array $data, array $options, BubbleableMe
           break;
 
         case 'raw':
-          $replacements[$original] = $sanitize ? Html::escape($date) : $date;
+          $replacements[$original] = $date;
           break;
       }
     }
diff --git a/core/modules/taxonomy/src/Tests/TokenReplaceTest.php b/core/modules/taxonomy/src/Tests/TokenReplaceTest.php
index 4fcb0f1..3bc7827 100644
--- a/core/modules/taxonomy/src/Tests/TokenReplaceTest.php
+++ b/core/modules/taxonomy/src/Tests/TokenReplaceTest.php
@@ -134,17 +134,6 @@ function testTaxonomyTokenReplacement() {
       $this->assertEqual($output, $expected, format_string('Sanitized taxonomy term token %token replaced.', array('%token' => $input)));
     }
 
-    // Generate and test unsanitized tokens.
-    $tests['[term:name]'] = $term2->getName();
-    $tests['[term:description]'] = $term2->getDescription();
-    $tests['[term:parent:name]'] = $term1->getName();
-    $tests['[term:vocabulary:name]'] = $this->vocabulary->label();
-
-    foreach ($tests as $input => $expected) {
-      $output = $token_service->replace($input, array('term' => $term2), array('langcode' => $language_interface->getId(), 'sanitize' => FALSE));
-      $this->assertEqual($output, $expected, format_string('Unsanitized taxonomy term token %token replaced.', array('%token' => $input)));
-    }
-
     // Generate and test sanitized tokens.
     $tests = array();
     $tests['[vocabulary:vid]'] = $this->vocabulary->id();
@@ -160,15 +149,6 @@ function testTaxonomyTokenReplacement() {
       $output = $token_service->replace($input, array('vocabulary' => $this->vocabulary), array('langcode' => $language_interface->getId()));
       $this->assertEqual($output, $expected, format_string('Sanitized taxonomy vocabulary token %token replaced.', array('%token' => $input)));
     }
-
-    // Generate and test unsanitized tokens.
-    $tests['[vocabulary:name]'] = $this->vocabulary->label();
-    $tests['[vocabulary:description]'] = $this->vocabulary->getDescription();
-
-    foreach ($tests as $input => $expected) {
-      $output = $token_service->replace($input, array('vocabulary' => $this->vocabulary), array('langcode' => $language_interface->getId(), 'sanitize' => FALSE));
-      $this->assertEqual($output, $expected, format_string('Unsanitized taxonomy vocabulary token %token replaced.', array('%token' => $input)));
-    }
   }
 }
 
diff --git a/core/modules/taxonomy/taxonomy.tokens.inc b/core/modules/taxonomy/taxonomy.tokens.inc
index daf690b..6c33f57 100644
--- a/core/modules/taxonomy/taxonomy.tokens.inc
+++ b/core/modules/taxonomy/taxonomy.tokens.inc
@@ -97,7 +97,6 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable
   $token_service = \Drupal::token();
 
   $replacements = array();
-  $sanitize = !empty($options['sanitize']);
   $taxonomy_storage = \Drupal::entityManager()->getStorage('taxonomy_term');
   if ($type == 'term' && !empty($data['term'])) {
     $term = $data['term'];
@@ -109,11 +108,11 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable
           break;
 
         case 'name':
-          $replacements[$original] = $sanitize ? Html::escape($term->getName()) : $term->getName();
+          $replacements[$original] = $term->getName();
           break;
 
         case 'description':
-          $replacements[$original] = $sanitize ? $term->description->processed : $term->getDescription();
+          $replacements[$original] = $term->description->processed;
           break;
 
         case 'url':
@@ -131,14 +130,14 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable
         case 'vocabulary':
           $vocabulary = Vocabulary::load($term->bundle());
           $bubbleable_metadata->addCacheableDependency($vocabulary);
-          $replacements[$original] = Html::escape($vocabulary->label());
+          $replacements[$original] = $vocabulary->label();
           break;
 
         case 'parent':
           if ($parents = $taxonomy_storage->loadParents($term->id())) {
             $parent = array_pop($parents);
             $bubbleable_metadata->addCacheableDependency($parent);
-            $replacements[$original] = Html::escape($parent->getName());
+            $replacements[$original] = $parent->getName();
           }
           break;
       }
@@ -165,11 +164,11 @@ function taxonomy_tokens($type, $tokens, array $data, array $options, Bubbleable
           break;
 
         case 'name':
-          $replacements[$original] = $sanitize ? Html::escape($vocabulary->label()) : $vocabulary->label();
+          $replacements[$original] = $vocabulary->label();
           break;
 
         case 'description':
-          $replacements[$original] = $sanitize ? Xss::filter($vocabulary->getDescription()) : $vocabulary->getDescription();
+          $replacements[$original] = $vocabulary->getDescription();
           break;
 
         case 'term-count':
diff --git a/core/modules/tour/src/Plugin/tour/tip/TipPluginText.php b/core/modules/tour/src/Plugin/tour/tip/TipPluginText.php
index bedb4bd..f525d83 100644
--- a/core/modules/tour/src/Plugin/tour/tip/TipPluginText.php
+++ b/core/modules/tour/src/Plugin/tour/tip/TipPluginText.php
@@ -121,7 +121,7 @@ public function getAttributes() {
    */
   public function getOutput() {
     $output = '<h2 class="tour-tip-label" id="tour-tip-' . $this->getAriaId() . '-label">' . Html::escape($this->getLabel()) . '</h2>';
-    $output .= '<p class="tour-tip-body" id="tour-tip-' . $this->getAriaId() . '-contents">' . Xss::filterAdmin($this->token->replace($this->getBody())) . '</p>';
+    $output .= '<p class="tour-tip-body" id="tour-tip-' . $this->getAriaId() . '-contents">' . $this->token->replace($this->getBody()) . '</p>';
     return array('#markup' => $output);
   }
 
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 73b9413..a811ba1 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -915,9 +915,8 @@ function user_mail($key, &$message, $params) {
   $language_manager->setConfigOverrideLanguage($language);
   $mail_config = \Drupal::config('user.mail');
 
-   // We do not sanitize the token replacement, since the output of this
-   // replacement is intended for an email message, not a web browser.
-  $token_options = array('langcode' => $langcode, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE);
+  // @todo fix this
+  $token_options = array('langcode' => $langcode, 'callback' => 'user_mail_tokens', 'clear' => TRUE);
   $message['subject'] .= $token_service->replace($mail_config->get($key . '.subject'), $variables, $token_options);
   $message['body'][] = $token_service->replace($mail_config->get($key . '.body'), $variables, $token_options);
 
diff --git a/core/modules/user/user.tokens.inc b/core/modules/user/user.tokens.inc
index 9cb61f6..c8b88e6 100644
--- a/core/modules/user/user.tokens.inc
+++ b/core/modules/user/user.tokens.inc
@@ -77,8 +77,6 @@ function user_tokens($type, $tokens, array $data, array $options, BubbleableMeta
   else {
     $langcode = NULL;
   }
-  $sanitize = !empty($options['sanitize']);
-
   $replacements = array();
 
   if ($type == 'user' && !empty($data['user'])) {
@@ -97,11 +95,11 @@ function user_tokens($type, $tokens, array $data, array $options, BubbleableMeta
           if ($account->isAnonymous()) {
             $bubbleable_metadata->addCacheableDependency(\Drupal::config('user.settings'));
           }
-          $replacements[$original] = $sanitize ? Html::escape($name) : $name;
+          $replacements[$original] = $name;
           break;
 
         case 'mail':
-          $replacements[$original] = $sanitize ? Html::escape($account->getEmail()) : $account->getEmail();
+          $replacements[$original] = $account->getEmail();
           break;
 
         case 'url':
diff --git a/core/modules/views/views.tokens.inc b/core/modules/views/views.tokens.inc
index 33d162b..cbdfea9 100644
--- a/core/modules/views/views.tokens.inc
+++ b/core/modules/views/views.tokens.inc
@@ -74,8 +74,6 @@ function views_tokens($type, $tokens, array $data, array $options, BubbleableMet
   if (isset($options['language'])) {
     $url_options['language'] = $options['language'];
   }
-  $sanitize = !empty($options['sanitize']);
-
   $replacements = array();
 
   if ($type == 'view' && !empty($data['view'])) {
@@ -87,11 +85,11 @@ function views_tokens($type, $tokens, array $data, array $options, BubbleableMet
     foreach ($tokens as $name => $original) {
       switch ($name) {
         case 'label':
-          $replacements[$original] = $sanitize ? Html::escape($view->storage->label()) : $view->storage->label();
+          $replacements[$original] = $view->storage->label();
           break;
 
         case 'description':
-          $replacements[$original] = $sanitize ? Html::escape($view->storage->get('description')) : $view->storage->get('description');
+          $replacements[$original] = $view->storage->get('description');
           break;
 
         case 'id':
@@ -100,7 +98,7 @@ function views_tokens($type, $tokens, array $data, array $options, BubbleableMet
 
         case 'title':
           $title = $view->getTitle();
-          $replacements[$original] = $sanitize ? Html::escape($title) : $title;
+          $replacements[$original] = $title;
           break;
 
         case 'url':
diff --git a/core/tests/Drupal/Tests/Core/Utility/TokenTest.php b/core/tests/Drupal/Tests/Core/Utility/TokenTest.php
index a738282..af5a59e 100644
--- a/core/tests/Drupal/Tests/Core/Utility/TokenTest.php
+++ b/core/tests/Drupal/Tests/Core/Utility/TokenTest.php
@@ -7,6 +7,7 @@
 
 namespace Drupal\Tests\Core\Utility;
 
+use Drupal\Component\Utility\Html;
 use Drupal\Core\Cache\Context\CacheContextsManager;
 use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Language\LanguageInterface;
@@ -262,4 +263,45 @@ public function testResetInfo() {
     $this->token->resetInfo();
   }
 
+  /**
+   * @covers ::replace
+   * @dataProvider providerTestReplaceEscaping
+   */
+  public function testReplaceEscaping($string, array $tokens, $expected) {
+    $this->moduleHandler->expects($this->any())
+      ->method('invokeAll')
+      ->willReturnCallback(function ($type, $args) {
+        return $args[2]['tokens'];
+      });
+
+    $this->assertEquals($expected, $this->token->replace($string, ['tokens' => $tokens]));
+  }
+
+  public function providerTestReplaceEscaping() {
+    $data = [];
+    $data['no-tokens'] = ['muh', [], 'muh'];
+    $data['html-in-string'] = ['<h1>Giraffe</h1>', [], '<h1>Giraffe</h1>'];
+    $data['html-in-string-quote'] = ['<h1>Giraffe"</h1>', [], '<h1>Giraffe"</h1>'];
+    $data['simple-placeholder'] = ['<h1>[token:meh]</h1>', ['[token:meh]' => 'muh'], '<h1>muh</h1>'];
+    $data['simple-placeholder-with-xss'] = [
+      '<h1>[token:meh]</h1>',
+      ['[token:meh]' => "<script>alert('123')</script>"],
+      '<h1>' . Html::escape("<script>alert('123')</script>") . '</h1>'
+    ];
+    // @todo what do we do with this particular case?
+    $data['simple-placeholder-with-attribute-xss'] = [
+      '<a href="[token:meh]">Giraffe</a>',
+      ['[token:meh]' => "javascript:alert('123')"],
+      '<a href="' . Html::escape("javascript:alert('123')") . '">Giraffe</a>',
+    ];
+    // @todo what do we do with this particular case?
+    $data['simple-placeholder-with-attribute-xss'] = [
+      '<a href="[token:meh]">Giraffe</a>',
+      ['[token:meh]' => '" onclick=alert(muh)"'],
+      '<a href="&quot; onclick=alert(muh)&quot;">Giraffe</a>',
+    ];
+
+    return $data;
+  }
+
 }