diff --git a/core/includes/theme.inc b/core/includes/theme.inc
index 4c3d0dc..4d441f2 100644
--- a/core/includes/theme.inc
+++ b/core/includes/theme.inc
@@ -1350,7 +1350,7 @@ function template_preprocess_page(&$variables) {
   $variables['language']          = $language_interface;
   $variables['logo']              = theme_get_setting('logo.url');
   $variables['site_name']         = (theme_get_setting('features.name') ? SafeMarkup::checkPlain($site_config->get('name')) : '');
-  $variables['site_slogan']       = (theme_get_setting('features.slogan') ? SafeMarkup::xssFilterAdmin($site_config->get('slogan')) : '');
+  $variables['site_slogan']['#markup'] = (theme_get_setting('features.slogan') ? $site_config->get('slogan') : '');
 
   // An exception might be thrown.
   try {
diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index 1db705e..9352b38 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -15,9 +15,9 @@
  * provides a store for known safe strings and methods to manage them
  * throughout the page request.
  *
- * Strings sanitized by self::checkPlain() or Xss::filter() are automatically
- * marked safe, as are markup strings created from render arrays via
- * drupal_render().
+ * Strings sanitized by self::checkPlain(), self::xssFilter() or
+ * self::xssFilterAdmin() are automatically marked safe, as are markup strings
+ * created from render arrays via drupal_render().
  *
  * This class should be limited to internal use only. Module developers should
  * instead use the appropriate
@@ -139,18 +139,22 @@ public static function escape($string) {
   }
 
   /**
-   * Applies a very permissive XSS/HTML filter for admin-only use.
+   * Filters HTML intended for admin use for XSS and marks the result as safe.
    *
-   * This method is preferred to \Drupal\Component\Utility\Xss::filterAdmin()
-   * when the result is being used directly in the rendering system. If the
-   * caller does not want to filter strings that are marked safe already it
-   * needs to check \Drupal\Component\Utility\SafeMarkup::isSafe() itself.
+   * This method should be used instead of
+   * \Drupal\Component\Utility\Xss::filterAdmin() when the result is being added
+   * to a render array that is constructed before rendering begins. Calling this
+   * method unnecessarily will result in bloating the safe string list and
+   * increases the chance of unintended side-effects.
+   *
+   * If the caller does not want to filter strings that are marked safe already
+   * it needs to check \Drupal\Component\Utility\SafeMarkup::isSafe() itself.
    *
    * @param string $string
    *   A string.
    *
    * @return string
-   *   The escaped string.
+   *   The filtered string. The string is marked as safe.
    *
    * @see \Drupal\Component\Utility\Xss::filterAdmin()
    */
@@ -163,7 +167,9 @@ public static function xssFilterAdmin($string) {
    * Applies a very permissive XSS/HTML filter for admin-only use, if not safe.
    *
    * @deprecated as of Drupal 8.0.x, will be removed before Drupal 8.0.0. Use
-   *   \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() instead.
+   *   \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() instead. If the
+   *   caller does not want to filter strings that are marked safe already it
+   *   needs to check \Drupal\Component\Utility\SafeMarkup::isSafe() itself.
    *
    * @see \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin()
    */
@@ -172,10 +178,13 @@ public static function checkAdminXss($string) {
   }
 
   /**
-   * Filters HTML to prevent cross-site-scripting (XSS) vulnerabilities.
+   * Filters HTML for XSS vulnerabilities and marks the result as safe.
    *
-   * This method is preferred to \Drupal\Component\Utility\Xss::filter() when
-   * the result is being used directly in the rendering system.
+   * This method should be used instead of
+   * \Drupal\Component\Utility\Xss::filter() when the result is being added to a
+   * render array that is construct before rendering begins. Calling this method
+   * unnecessarily will result in bloating the safe string list and increases
+   * the chance of unintended side-effects.
    *
    * @param $string
    *   The string with raw HTML in it. It will be stripped of everything that
@@ -186,7 +195,7 @@ public static function checkAdminXss($string) {
    *
    * @return string
    *   An XSS safe version of $string, or an empty string if $string is not
-   *   valid UTF-8.
+   *   valid UTF-8. The string is marked as safe.
    *
    * @see \Drupal\Component\Utility\Xss::filter()
    */
diff --git a/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
index 3bde0d0..a4efad1 100644
--- a/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -32,7 +32,9 @@ class Xss {
    * This method is preferred to
    * \Drupal\Component\Utility\SafeMarkup::xssFilter() when the result is
    * not being used directly in the rendering system (for example, when its
-   * result is being combined with other strings before rendering).
+   * result is being combined with other strings before rendering). This avoids
+   * bloating the safe string list with partial strings if the whole result will
+   * be marked safe.
    *
    * This code does four things:
    * - Removes characters and constructs that can trick browsers.
@@ -109,7 +111,9 @@ public static function filter($string, $html_tags = array('a', 'em', 'strong', '
    * This method is preferred to
    * \Drupal\Component\Utility\SafeMarkup::xssFilterAdmin() when the result is
    * not being used directly in the rendering system (for example, when its
-   * result is being combined with other strings before rendering).
+   * result is being combined with other strings before rendering). This avoids
+   * bloating the safe string list with partial strings if the whole result will
+   * be marked safe.
    *
    * Allows all tags that can be used inside an HTML body, save
    * for scripts and styles.
diff --git a/core/lib/Drupal/Core/Render/Renderer.php b/core/lib/Drupal/Core/Render/Renderer.php
index 2ef044a..80b52de 100644
--- a/core/lib/Drupal/Core/Render/Renderer.php
+++ b/core/lib/Drupal/Core/Render/Renderer.php
@@ -667,6 +667,8 @@ public function addCacheableDependency(array &$elements, $dependency) {
    *   be escaped again.
    */
   protected function xssFilterAdminIfUnsafe($string) {
+    // @todo https://www.drupal.org/node/2506581 replace with
+    //   Xss::filterAdmin().
     return SafeMarkup::isSafe($string) ? $string : SafeMarkup::xssFilterAdmin($string);
   }
 
diff --git a/core/modules/node/node.module b/core/modules/node/node.module
index f3be5b6..f422c4e 100644
--- a/core/modules/node/node.module
+++ b/core/modules/node/node.module
@@ -492,30 +492,6 @@ function node_is_page(NodeInterface $node) {
 }
 
 /**
- * Prepares variables for list of available node type templates.
- *
- * Default template: node-add-list.html.twig.
- *
- * @param array $variables
- *   An associative array containing:
- *   - content: An array of content types.
- *
- * @see node_add_page()
- */
-function template_preprocess_node_add_list(&$variables) {
-  $variables['types'] = array();
-  if (!empty($variables['content'])) {
-    foreach ($variables['content'] as $type) {
-      $variables['types'][$type->id()] = array(
-        'type' => $type->id(),
-        'add_link' => \Drupal::l($type->label(), new Url('node.add', array('node_type' => $type->id()))),
-        'description' => SafeMarkup::xssFilterAdmin($type->getDescription()),
-      );
-    }
-  }
-}
-
-/**
  * Implements hook_preprocess_HOOK() for HTML document templates.
  */
 function node_preprocess_html(&$variables) {
diff --git a/core/modules/node/src/NodeTypeListBuilder.php b/core/modules/node/src/NodeTypeListBuilder.php
index 46bec74..2e4b442 100644
--- a/core/modules/node/src/NodeTypeListBuilder.php
+++ b/core/modules/node/src/NodeTypeListBuilder.php
@@ -7,10 +7,10 @@
 
 namespace Drupal\node;
 
+use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Config\Entity\ConfigEntityListBuilder;
 use Drupal\Core\Url;
 use Drupal\Core\Entity\EntityInterface;
-use Drupal\Component\Utility\Xss;
 
 /**
  * Defines a class to build a listing of node type entities.
@@ -39,7 +39,7 @@ public function buildRow(EntityInterface $entity) {
       'data' => $this->getLabel($entity),
       'class' => array('menu-label'),
     );
-    $row['description'] = Xss::filterAdmin($entity->getDescription());
+    $row['description'] = SafeMarkup::xssFilterAdmin($entity->getDescription());
     return $row + parent::buildRow($entity);
   }
 
diff --git a/core/modules/node/templates/node-add-list.html.twig b/core/modules/node/templates/node-add-list.html.twig
index c64751b..c878b45 100644
--- a/core/modules/node/templates/node-add-list.html.twig
+++ b/core/modules/node/templates/node-add-list.html.twig
@@ -10,8 +10,6 @@
  *   - add_link: Link to create a piece of content of this type.
  *   - description: Description of this type of content.
  *
- * @see template_preprocess_node_add_list()
- *
  * @ingroup themeable
  */
 #}
diff --git a/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
index 117ba2c..16b0368 100644
--- a/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
+++ b/core/modules/system/src/Plugin/Block/SystemBrandingBlock.php
@@ -174,7 +174,7 @@ public function build() {
     );
 
     $build['site_slogan'] = array(
-      '#markup' => SafeMarkup::xssFilterAdmin($site_config->get('slogan')),
+      '#markup' => $site_config->get('slogan'),
       '#access' => $this->configuration['use_site_slogan'],
     );